rch_common/

patterns.rs

//! Command classification patterns for identifying compilation commands.
//!
//! Implements the 5-tier classification system:
//! - Tier 0: Instant reject (non-Bash, empty)
//! - Tier 1: Structure analysis (pipes, redirects, background)
//! - Tier 2: SIMD keyword filter
//! - Tier 3: Negative pattern check
//! - Tier 4: Full classification with confidence

use schemars::JsonSchema;
use serde::{Deserialize, Serialize};
use std::borrow::Cow;

// Tier name constants (avoid allocations on hot path).
const TIER_INSTANT_REJECT: &str = "instant_reject";
const TIER_STRUCTURE_ANALYSIS: &str = "structure_analysis";
const TIER_KEYWORD_FILTER: &str = "keyword_filter";
const TIER_NEVER_INTERCEPT: &str = "never_intercept";
const TIER_FULL_CLASSIFICATION: &str = "full_classification";

/// Keywords that indicate a potential compilation command.
/// Used for SIMD-accelerated quick filtering (Tier 2).
pub static COMPILATION_KEYWORDS: &[&str] = &[
    "cargo",
    // The standalone cargo-zigbuild binary (hyphenated) does NOT word-match
    // "cargo", so it needs its own Tier-2 keyword or it is rejected before
    // classify_full's `cargo-zigbuild` route ever runs.
    "cargo-zigbuild",
    "cargo-xwin",
    "rustc",
    "gcc",
    "g++",
    "clang",
    "clang++",
    "make",
    "cmake",
    "ninja",
    "meson",
    "cc",
    "c++",
    "bun",
    "nextest",
    "nix",
    "nix-build",
    "go",
    "tsc",
    "npx",
];

/// Commands that should NEVER be intercepted, even if they contain compilation keywords.
/// These either modify local state or have dependencies on local execution.
pub static NEVER_INTERCEPT: &[&str] = &[
    // Cargo commands that modify local state or shouldn't be intercepted
    "cargo install",
    // `cargo publish` is checked in classify_cargo: only an explicit dry-run
    // with package verification enabled is a remote compilation command.
    "cargo login",
    "cargo fmt",
    "cargo fix",
    "cargo clean",
    "cargo new",
    "cargo init",
    "cargo add",
    "cargo remove",
    "cargo update",
    "cargo generate-lockfile",
    "cargo watch",
    "cargo --version",
    "cargo -V",
    // Compiler version checks
    "rustc --version",
    "rustc -V",
    "gcc --version",
    "gcc -v",
    "clang --version",
    "clang -v",
    "make --version",
    "make -v",
    "cmake --version",
    // Bun package management - MUST NOT intercept (modifies local state)
    "bun install",
    "bun add",
    "bun remove",
    "bun link",
    "bun unlink",
    "bun pm",
    "bun init",
    "bun create",
    "bun upgrade",
    "bun completions",
    // Bun execution that shouldn't be intercepted
    "bun run",
    "bun build",
    "bun --help",
    "bun -h",
    "bun --version",
    "bun -v",
    // Bun dev/repl - require local interactivity
    "bun dev",
    "bun repl",
    // cargo-nextest commands that shouldn't be intercepted
    "cargo nextest list",    // Lists tests only, doesn't run them
    "cargo nextest archive", // Creates test archives
    "cargo nextest show",    // Shows config/setup info
    // Go commands that mutate local state, run programs, or are trivially fast.
    // Only `go build` / `go test` / `go vet` are offloadable (see classify_go).
    "go get",      // mutates go.mod / module cache
    "go mod",      // mutates go.mod / go.sum
    "go work",     // mutates go.work
    "go install",  // writes a binary into local GOBIN
    "go run",      // runs a program locally (may be interactive / long-lived)
    "go generate", // executes arbitrary local codegen
    "go fmt",      // rewrites local source files
    "go clean",    // mutates local caches
    "go env",      // trivial; also used to *set* local env
    "go doc",      // trivial lookup
    "go version",  // trivial
    "go tool",     // arbitrary tool execution
    "go list",     // metadata query; cheap, and agents parse it locally
    // TypeScript: version/init are trivial or mutate local state
    "tsc --version",
    "tsc -v",
    "tsc --init",
];

/// Result of command classification.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Classification {
    /// Whether this is a compilation command.
    pub is_compilation: bool,
    /// Confidence score (0.0-1.0).
    pub confidence: f64,
    /// The kind of compilation if detected.
    pub kind: Option<CompilationKind>,
    /// Reason for the classification decision.
    pub reason: Cow<'static, str>,
    /// For compound commands (e.g., "cd /path && cargo build"), this contains
    /// the prefix that should run before the compilation ("cd /path && ").
    /// None for simple commands.
    pub command_prefix: Option<String>,
    /// For compound commands, this contains the extracted compilation command
    /// (e.g., "cargo build --release"). None for simple commands where the
    /// entire input is the compilation command.
    pub extracted_command: Option<String>,
}

/// Decision outcome for a classification tier.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum TierDecision {
    Pass,
    Reject,
}

/// Detailed result for a single classification tier.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct ClassificationTier {
    /// Tier index (0-4).
    pub tier: u8,
    /// Tier name.
    pub name: Cow<'static, str>,
    /// Decision for this tier.
    pub decision: TierDecision,
    /// Reason for the decision.
    pub reason: Cow<'static, str>,
}

/// Detailed classification results with per-tier decisions.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct ClassificationDetails {
    /// Original command string.
    pub original: String,
    /// Normalized command string (wrappers stripped).
    pub normalized: String,
    /// Per-tier decisions.
    pub tiers: Vec<ClassificationTier>,
    /// Final classification result.
    pub classification: Classification,
}

impl Classification {
    /// Create a non-compilation classification.
    pub fn not_compilation(reason: impl Into<Cow<'static, str>>) -> Self {
        Self {
            is_compilation: false,
            confidence: 0.0,
            kind: None,
            reason: reason.into(),
            command_prefix: None,
            extracted_command: None,
        }
    }

    /// Create a compilation classification.
    pub fn compilation(
        kind: CompilationKind,
        confidence: f64,
        reason: impl Into<Cow<'static, str>>,
    ) -> Self {
        Self {
            is_compilation: true,
            confidence,
            kind: Some(kind),
            reason: reason.into(),
            command_prefix: None,
            extracted_command: None,
        }
    }

    /// Create a compilation classification for a compound command.
    /// The prefix contains everything before the compilation command (including the final "&&" or ";").
    /// The extracted_command is the actual compilation command to intercept.
    pub fn compound_compilation(
        kind: CompilationKind,
        confidence: f64,
        reason: impl Into<Cow<'static, str>>,
        prefix: String,
        extracted: String,
    ) -> Self {
        Self {
            is_compilation: true,
            confidence,
            kind: Some(kind),
            reason: reason.into(),
            command_prefix: Some(prefix),
            extracted_command: Some(extracted),
        }
    }
}

/// Kind of compilation command detected.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum CompilationKind {
    // Rust commands
    /// cargo build, cargo test, cargo check, etc.
    CargoBuild,
    CargoTest,
    CargoCheck,
    CargoClippy,
    CargoDoc,
    /// cargo nextest run - next-generation test runner
    CargoNextest,
    /// cargo bench - run benchmarks
    CargoBench,
    /// `cargo zigbuild` / `cargo-zigbuild zigbuild` — a cargo build that uses
    /// zig as the C compiler + cross-linker (`cargo-zigbuild`). It IS a Rust
    /// build (RequiredRuntime::Rust), but additionally needs `zig` +
    /// `cargo-zigbuild` on the worker and the requested `--target` rustup std.
    /// Unlike Go/Nix it PRODUCES a real binary under `target/<triple>/<profile>/`,
    /// so its artifacts must sync back (see artifact_patterns).
    CargoZigbuild,
    /// rustc invocation
    Rustc,

    // C/C++ commands
    /// GCC compilation
    Gcc,
    /// G++ compilation
    Gpp,
    /// Clang compilation
    Clang,
    /// Clang++ compilation
    Clangpp,

    // Build systems
    /// make build
    Make,
    /// cmake --build
    CmakeBuild,
    /// ninja build
    Ninja,
    /// meson compile
    Meson,

    // Bun commands
    /// bun test - Runs Bun's built-in test runner
    BunTest,
    /// bun typecheck - Runs TypeScript type checking
    BunTypecheck,

    // Go commands
    //
    // Only the non-emitting forms are offloaded. `go build -o <file>` writes a
    // binary the caller expects to find locally, so classify_go declines it and
    // it runs locally — a remote build whose artifact never came home would be a
    // silent correctness bug. Plain `go build ./...` is a compile check that
    // produces no output file, so exit status is the whole payload.
    /// `go build ./...` (compile check; no `-o` output file)
    GoBuild,
    /// `go test ./...`
    GoTest,
    /// `go vet ./...`
    GoVet,

    // TypeScript
    /// `tsc --noEmit` / `npx tsc --noEmit` (typecheck only; emitting runs stay local)
    Tsc,

    // Nix commands
    /// `nix build` / `nix-build` (derivation build), `nix flake check`
    /// (evaluate + build all outputs), and the non-interactive
    /// `nix develop -c <cmd>` / `nix shell -c <cmd>` forms.
    ///
    /// Nix outputs live in the worker's `/nix/store` behind a `result` symlink
    /// that is meaningless on a nix-less local host, so these run as
    /// streaming, no-artifact-return commands (exit status is the payload).
    NixBuild,

    // Explicit job admission
    /// Arbitrary non-compilation workload admitted explicitly via
    /// `rch exec --job` (sharded tests, fuzzing, benchmarks, mutation testing).
    ///
    /// NEVER produced by [`classify_command`] or the PreToolUse hook — the sole
    /// constructor is the explicit `--job` flag on `rch exec`, so the hook can
    /// never auto-delegate a command the classifier did not intercept. A job
    /// rides the normal selection/sync/execute/heartbeat/release rails, syncs
    /// no artifacts back automatically (exit status is the payload in this
    /// phase), and surfaces the remote exit status verbatim without
    /// toolchain/worker-environment reinterpretation.
    Job,
}

impl CompilationKind {
    /// Returns true if this is a test-related command.
    ///
    /// Test commands have special cache affinity behavior because test binaries
    /// (e.g., target/debug/deps/) are expensive to compile and benefit more
    /// from warm caches than regular builds.
    pub fn is_test_command(&self) -> bool {
        matches!(
            self,
            CompilationKind::CargoTest
                | CompilationKind::CargoNextest
                | CompilationKind::CargoBench
                | CompilationKind::BunTest
                | CompilationKind::GoTest
        )
    }

    /// Returns the base command name for allowlist matching (bd-785w).
    ///
    /// This is the primary executable name that should appear in the
    /// execution allowlist configuration.
    pub fn command_base(&self) -> &'static str {
        match self {
            // Rust commands
            CompilationKind::CargoBuild
            | CompilationKind::CargoTest
            | CompilationKind::CargoCheck
            | CompilationKind::CargoClippy
            | CompilationKind::CargoDoc
            | CompilationKind::CargoBench => "cargo",
            CompilationKind::CargoNextest => "cargo", // cargo nextest, base is still cargo
            // `cargo zigbuild` runs through cargo; the standalone `cargo-zigbuild`
            // binary is normalized to this kind too. Base "cargo" so it matches
            // the existing cargo allowlist entry.
            CompilationKind::CargoZigbuild => "cargo",
            CompilationKind::Rustc => "rustc",
            // C/C++ commands
            CompilationKind::Gcc => "gcc",
            CompilationKind::Gpp => "g++",
            CompilationKind::Clang => "clang",
            CompilationKind::Clangpp => "clang++",
            // Build systems
            CompilationKind::Make => "make",
            CompilationKind::CmakeBuild => "cmake",
            CompilationKind::Ninja => "ninja",
            CompilationKind::Meson => "meson",
            // Bun commands
            CompilationKind::BunTest | CompilationKind::BunTypecheck => "bun",
            // Nix commands. Both `nix build` and the legacy `nix-build` route
            // through this kind; the canonical allowlist base name is "nix".
            CompilationKind::NixBuild => "nix",
            // Go commands
            CompilationKind::GoBuild | CompilationKind::GoTest | CompilationKind::GoVet => "go",
            // TypeScript. Both `tsc` and `npx tsc` route through this kind; the
            // canonical allowlist base name is "tsc".
            CompilationKind::Tsc => "tsc",
            // Explicit job admission has no single executable base: a job's
            // argv[0] is arbitrary. The hook-path execution-allowlist gate can
            // never observe this kind (only `rch exec --job` constructs it), so
            // this token exists to keep the mapping total, not to match an
            // allowlist entry.
            CompilationKind::Job => "job",
        }
    }
}

/// Classify a shell command.
///
/// Implements the 5-tier classification system for maximum precision with
/// minimal latency on non-compilation commands.
///
/// Pure `&&` chains with a compilation command as the final segment are
/// accepted and rewritten to wrap only that final command. Other multi-command
/// strings are rejected by Tier 1 structure analysis to prevent unsafe partial
/// interception.
pub fn classify_command(cmd: &str) -> Classification {
    classify_command_inner(cmd, 0)
}

/// Detect a command that *would* be a compilation command if it weren't for an
/// (unsafe / unhandled) pipe/redirect/background/subshell structure — i.e. one
/// that the classifier declines purely because of its shell structure rather
/// than because the underlying program is not a compiler (issue #24, item 3).
///
/// Returns the structural reason (e.g. "piped command", "subshell execution")
/// when the leading program token IS a known compilation tool but the command
/// is declined by Tier 1 structure analysis. Returns `None` otherwise (so the
/// hint is only surfaced for genuine structure-driven declines, never for
/// `ls | grep cargo` and friends).
///
/// Callers (the hook) can use this to emit an observable hint/warn when running
/// on an orchestrator with `force_remote = true`, so the silent local fallback
/// becomes visible.
pub fn declined_compilation_due_to_structure(cmd: &str) -> Option<&'static str> {
    let trimmed = cmd.trim();
    if trimmed.is_empty() {
        return None;
    }
    // If the full classifier already accepts (and will offload) it, there is no
    // decline to report.
    if classify_command(trimmed).is_compilation {
        return None;
    }
    // Only report when Tier 1 structure analysis is the reason AND the leading
    // program word is a recognized compilation tool.
    let reason = check_structure(trimmed)?;
    let normalized = normalize_command(trimmed);
    if starts_with_compilation_command(normalized.as_ref()) {
        Some(reason)
    } else {
        None
    }
}

/// Maximum recursion depth for multi-command splitting.
/// Depth 0 = top-level call that may split; depth 1 = sub-command (no further splitting).
#[allow(dead_code)] // Reserved for future multi-command classification
const MAX_CLASSIFY_DEPTH: u8 = 1;

/// Maximum command length for multi-command splitting (10 KB).
/// Commands longer than this skip splitting and are classified as a single command.
#[allow(dead_code)] // Reserved for future multi-command classification
const MAX_SPLIT_INPUT_LEN: usize = 10 * 1024;

fn classify_command_inner(cmd: &str, depth: u8) -> Classification {
    let cmd = cmd.trim();

    // Tier 0: Instant reject - empty command
    if cmd.is_empty() {
        return Classification::not_compilation("empty command");
    }

    // Tier 0.5: Compound command handling (only at depth 0)
    // For commands like "cd /path && cargo build", extract and classify the last segment.
    // We only handle && chains (not || or ;) at depth 0 to avoid complex rewriting.
    if depth == 0
        && cmd.len() < MAX_SPLIT_INPUT_LEN
        && let Some(result) = try_classify_compound_command(cmd)
    {
        return result;
    }

    // Tier 0.6: Wrapper / benign-suffix handling (only at depth 0).
    //
    // Handles the dominant agent invocation forms that would otherwise be
    // rejected by Tier 1 structure analysis and silently fall back to local
    // compilation (issue #24):
    //   - `bash -c "cargo test ..."` / `sh -c "cargo test ..."` (extract inner)
    //   - `cargo check --lib 2>&1 | head`  (pipe into a benign pager)
    //   - `cargo test ... > file 2>&1`     (benign stdout/stderr file redirect)
    //   - `cargo test ... &`               (backgrounding)
    //
    // We stay conservative: only the leading compilation command is offloaded,
    // and the benign trailing structure is re-attached to the offloaded
    // command's output stream (`rch exec -- <cmd> <suffix>`). We never offload
    // when the pipeline transforms the command's INPUT or chains another build.
    if depth == 0 && cmd.len() < MAX_SPLIT_INPUT_LEN {
        if let Some(result) = try_classify_wrapped_command(cmd) {
            return result;
        }
        if let Some(result) = try_classify_benign_suffix_command(cmd) {
            return result;
        }
    }

    // Tier 1: Structure analysis - reject complex shell structures
    if let Some(reason) = check_structure(cmd) {
        return Classification::not_compilation(reason);
    }

    // Normalize command for Tier 3 and 4
    let normalized_cow = normalize_command(cmd);
    let normalized = normalized_cow.as_ref();

    // Tier 2: quick check for compilation commands.
    //
    // This intentionally checks the normalized command word, not arbitrary
    // arguments. A Beads comment like `br comments add ... "cargo test ..."`
    // mentions compilation text, but it is not invoking a compiler.
    if !starts_with_compilation_command(normalized) {
        return Classification::not_compilation("no compilation keyword");
    }

    // Tier 3: Negative pattern check - never intercept these
    // Performance: use static string to avoid format! allocation on hot rejection path
    for pattern in NEVER_INTERCEPT {
        if let Some(rest) = normalized.strip_prefix(pattern) {
            // Ensure exact match or boundary match (e.g. "cargo clean" matches "cargo clean"
            // or "cargo clean ", but NOT "cargo cleanup")
            if rest.is_empty() || rest.starts_with(' ') {
                return Classification::not_compilation("matches never-intercept pattern");
            }
        }
    }

    // Tier 4: Full classification
    classify_full(normalized)
}

/// Try to classify a compound command (e.g., "cd /path && cargo build").
///
/// For && chains, we check if the LAST segment is a compilation command.
/// If so, we return a compound_compilation with the prefix (everything before
/// the compilation) and the extracted compilation command.
///
/// This allows commands like:
/// - "cd /path && cargo build" → prefix="cd /path && ", extracted="cargo build"
/// - "touch file && cargo test" → prefix="touch file && ", extracted="cargo test"
///
/// We only handle && chains, not || or ; for safety (those have different semantics).
/// We also reject commands with pipes, redirects, or subshells in ANY segment.
fn try_classify_compound_command(cmd: &str) -> Option<Classification> {
    // Quick check: must contain && but not other problematic operators
    if !cmd.contains("&&") {
        return None;
    }

    // Reject if command contains pipes, redirects, or subshells (anywhere)
    // These make command rewriting unsafe
    if cmd.contains('|') {
        return None; // Pipe or || chain
    }
    if has_file_redirect(cmd) {
        return None; // File redirects (but NOT fd-to-fd like 2>&1)
    }
    if cmd.contains('(') || cmd.contains('`') || cmd.contains("$(") {
        return None; // Subshells
    }
    if cmd.contains(';') {
        return None; // Only handle pure && chains for now
    }

    // Split on && (simple split, respects quotes via split_and_chain)
    let segments = split_and_chain(cmd)?;
    if segments.is_empty() {
        return None;
    }

    // Get the last segment and classify it
    let last_segment = segments.last()?.trim();
    if last_segment.is_empty() {
        return None;
    }

    // Classify the last segment at depth 1 (prevents infinite recursion)
    let last_classification = classify_command_inner(last_segment, 1);

    if !last_classification.is_compilation {
        return None;
    }

    if segments.len() == 1 {
        // No prefix, just the command itself
        return None;
    }

    // Build the prefix: every earlier segment, joined back with " && ".
    //
    // Issue #50: earlier segments that are themselves compilations are wrapped
    // with `rch exec -- ` here, so the hook's `{prefix}rch exec -- {extracted}`
    // rewrite offloads EVERY build in the chain. Previously only the final
    // segment was wrapped and `cargo build --release && cargo test` compiled
    // the first half locally on the dispatcher with no summary line at all.
    // Segments that do not classify (cd, touch, `go build -o app`, ...)
    // are re-emitted verbatim.
    let mut prefix = String::with_capacity(cmd.len() + segments.len() * EXEC_REWRITE_PREFIX.len());
    for segment in &segments[..segments.len() - 1] {
        if classify_command_inner(segment, 1).is_compilation {
            prefix.push_str(EXEC_REWRITE_PREFIX);
        }
        prefix.push_str(segment);
        prefix.push_str(" && ");
    }

    // Return compound classification
    Some(Classification::compound_compilation(
        last_classification.kind?,
        last_classification.confidence,
        "compound command with compilation suffix",
        prefix,
        last_segment.to_string(),
    ))
}

/// The rewrite the hook applies to an offloaded segment. Kept here so the
/// compound classifier and the hook agree byte-for-byte on the wrapped form.
const EXEC_REWRITE_PREFIX: &str = "rch exec -- ";

/// Segments of an `&&` chain (all but the last) that *look* like a compilation
/// command but were not classified as one, and therefore stay local when the
/// chain is rewritten by the hook (issue #50).
///
/// Example: `go build -o app ./cmd && cargo test` — `go build -o` emits a
/// local binary and is never offloaded, so the hook rewrites only `cargo test`;
/// this returns `["go build -o app ./cmd"]` so the hook can say so instead of
/// staying silent.
/// Returns an empty vector for anything that is not a plain `&&` chain.
pub fn compound_local_compilation_segments(cmd: &str) -> Vec<String> {
    let trimmed = cmd.trim();
    if trimmed.len() >= MAX_SPLIT_INPUT_LEN {
        return Vec::new();
    }
    let Some(segments) = split_and_chain(trimmed) else {
        return Vec::new();
    };
    if segments.len() < 2 {
        return Vec::new();
    }
    segments[..segments.len() - 1]
        .iter()
        .filter(|segment| {
            !classify_command_inner(segment, 1).is_compilation
                && starts_with_compilation_command(normalize_command(segment).as_ref())
        })
        .map(|segment| (*segment).to_string())
        .collect()
}

/// Benign pager/sink commands that may sit on the right-hand side of a pipe
/// without transforming the build's *input*. Piping a compilation command's
/// output into one of these is safe to offload — the offloaded command's
/// output is simply re-piped into the same pager locally.
///
/// We intentionally keep this list small and conservative. Commands that
/// would alter exit status semantics in a surprising way, or that consume
/// and re-emit transformed data feeding a subsequent build, are excluded.
const BENIGN_PAGER_COMMANDS: &[&str] = &[
    "tee", "head", "cat", "grep", "less", "more", "tail", "wc", "rg",
];

/// Try to classify a `bash -c "<cmd>"` / `sh -c "<cmd>"` wrapper by extracting
/// and classifying the inner command (issue #24, item 2).
///
/// On success the inner command is offloaded directly (the shell wrapper is
/// dropped, since `rch exec -- <inner>` runs the same program). We mirror the
/// `cd X && ...` compound handling: the inner command is classified at depth 0
/// so it can itself be a compound / benign-suffix / further-wrapped command.
///
/// Conservative: we only handle the simple, single-quoted-string form
/// `bash -c "<inner>"` with no trailing tokens after the inner string and no
/// extra flags before `-c`. Anything more exotic falls through to Tier 1.
fn try_classify_wrapped_command(cmd: &str) -> Option<Classification> {
    let cmd = cmd.trim();

    // Match `bash -c` or `sh -c` (also /bin/bash, /usr/bin/sh, etc.) followed by
    // a single quoted argument that is the entire remainder of the command.
    let rest = strip_shell_dash_c_prefix(cmd)?;
    let rest = rest.trim_start();

    // The remainder must be a single quoted string and nothing else after it.
    let inner = extract_single_quoted_argument(rest)?;
    if inner.trim().is_empty() {
        return None;
    }

    // Classify the inner command at depth 0 so it can itself be compound or
    // carry a benign suffix (e.g. `bash -c "cd x && cargo test > log 2>&1"`).
    let inner_classification = classify_command_inner(&inner, 0);
    if !inner_classification.is_compilation {
        return None;
    }

    // Rebuild the command that should actually be offloaded. If the inner
    // command was itself compound/suffixed, prefer its rewritten form so the
    // prefix/suffix is preserved; otherwise the inner command is offloaded
    // verbatim.
    let (prefix, extracted) = match (
        &inner_classification.command_prefix,
        &inner_classification.extracted_command,
    ) {
        (Some(p), Some(e)) => (p.clone(), e.clone()),
        _ => (String::new(), inner.trim().to_string()),
    };

    Some(Classification::compound_compilation(
        inner_classification.kind?,
        inner_classification.confidence,
        "shell -c wrapper with compilation command",
        prefix,
        extracted,
    ))
}

/// Strip a leading `bash -c` / `sh -c` (with optional absolute path) and return
/// the remainder of the command. Returns `None` if the prefix does not match.
fn strip_shell_dash_c_prefix(cmd: &str) -> Option<&str> {
    // Split the leading whitespace-delimited words to inspect the shell + flag,
    // but return a slice of the ORIGINAL string for the remainder so quoting in
    // the inner argument is preserved.
    let trimmed = cmd.trim_start();
    let mut idx = 0;
    let bytes = trimmed.as_bytes();

    // Word 1: the shell executable.
    let word1_end = next_word_end(bytes, idx)?;
    let shell = &trimmed[idx..word1_end];
    if !shell_basename_is(shell, "bash") && !shell_basename_is(shell, "sh") {
        return None;
    }
    idx = skip_spaces(bytes, word1_end);

    // Word 2: must be exactly `-c`.
    let word2_end = next_word_end(bytes, idx)?;
    if &trimmed[idx..word2_end] != "-c" {
        return None;
    }
    idx = skip_spaces(bytes, word2_end);

    if idx >= trimmed.len() {
        return None;
    }
    Some(&trimmed[idx..])
}

/// Return true if `word`'s basename (after the last `/`) equals `name`.
fn shell_basename_is(word: &str, name: &str) -> bool {
    word.rsplit('/').next().map(|b| b == name).unwrap_or(false)
}

/// Index just past the end of the (unquoted) word starting at `start`.
/// Returns `None` if `start` is already at end of input.
fn next_word_end(bytes: &[u8], start: usize) -> Option<usize> {
    if start >= bytes.len() || bytes[start].is_ascii_whitespace() {
        return None;
    }
    let mut i = start;
    while i < bytes.len() && !bytes[i].is_ascii_whitespace() {
        i += 1;
    }
    Some(i)
}

/// Skip ASCII spaces/tabs starting at `start`, returning the next non-space index.
fn skip_spaces(bytes: &[u8], start: usize) -> usize {
    let mut i = start;
    while i < bytes.len() && bytes[i].is_ascii_whitespace() {
        i += 1;
    }
    i
}

/// Extract the contents of a single `"..."` or `'...'` quoted argument that
/// spans the ENTIRE input (modulo surrounding whitespace). Returns `None` if
/// the input is not exactly one quoted string (e.g. it has trailing tokens, or
/// embedded unescaped quotes of the same kind that would terminate early).
fn extract_single_quoted_argument(s: &str) -> Option<String> {
    let s = s.trim();
    let bytes = s.as_bytes();
    if bytes.len() < 2 {
        return None;
    }
    let quote = bytes[0];
    if quote != b'"' && quote != b'\'' {
        return None;
    }

    let mut out = String::with_capacity(s.len());
    let mut i = 1;
    while i < bytes.len() {
        let b = bytes[i];
        // Backslash escaping only applies inside double quotes (POSIX).
        if quote == b'"' && b == b'\\' && i + 1 < bytes.len() {
            out.push(bytes[i + 1] as char);
            i += 2;
            continue;
        }
        if b == quote {
            // Closing quote: everything after must be whitespace only.
            if s[i + 1..].trim().is_empty() {
                return Some(out);
            }
            return None;
        }
        out.push(b as char);
        i += 1;
    }
    // Unterminated quote.
    None
}

/// Try to classify a compilation command followed ONLY by a benign trailing
/// structure (issue #24, item 1):
///   - backgrounding: `cargo test ... &`
///   - benign stdout/stderr file redirect: `cargo test ... > file 2>&1`
///   - pipe into a benign pager: `cargo check --lib 2>&1 | head`
///
/// The leading command (everything before the first top-level structural
/// operator) is classified as a normal command. If it is a compilation
/// command, the benign suffix is re-attached to the offloaded command so the
/// shell re-applies it to `rch exec`'s output:
///   `cargo check --lib 2>&1 | head` → `rch exec -- cargo check --lib 2>&1 | head`
///
/// Conservative rejections (fall through to Tier 1):
///   - input redirects (`< file`) — transform the command's INPUT
///   - pipes into anything not on `BENIGN_PAGER_COMMANDS` (could chain a build
///     or transform data)
///   - any subshell / command substitution / `&&` / `||` / `;` chaining
///   - more than one pipe stage (keep it simple and safe)
fn try_classify_benign_suffix_command(cmd: &str) -> Option<Classification> {
    let cmd = cmd.trim();

    // This helper runs before the general Tier 1 structure check. Reject line
    // breaks here too, or a redirect/pipe on the first line can make a second
    // shell command look like part of an otherwise benign suffix.
    if cmd.bytes().any(|byte| matches!(byte, b'\n' | b'\r')) {
        return None;
    }

    // Bail out fast on chaining / subshell / capture / input-redirect forms;
    // those are handled (or rejected) elsewhere and are never "benign suffix".
    if cmd.contains("&&") || cmd.contains("||") || cmd.contains(';') {
        return None;
    }
    if cmd.contains('(') || cmd.contains('`') || cmd.contains("$(") {
        return None;
    }

    // Locate the first top-level (unquoted) structural boundary: a single `|`,
    // a standalone trailing `&`, or a file-redirect `>` / `<`.
    let boundary = find_first_structural_boundary(cmd)?;
    let (leading_raw, suffix_raw) = cmd.split_at(boundary.byte_pos);
    let leading = leading_raw.trim();
    let suffix = suffix_raw; // keep the operator + whatever follows
    if leading.is_empty() {
        return None;
    }

    // Validate the suffix is benign for this boundary kind.
    if !suffix_is_benign(boundary.kind, suffix) {
        return None;
    }

    // Classify the leading command at depth 1 so it is treated as a single
    // command (no further splitting / wrapper handling).
    let leading_classification = classify_command_inner(leading, 1);
    if !leading_classification.is_compilation {
        return None;
    }

    // Preserve the validated command verbatim. Rebuilding it with normalized
    // whitespace changes the meaning of adjacent file-descriptor redirects:
    // `cargo build 2>errors.txt` must not become `cargo build 2 >errors.txt`.
    let extracted = cmd.to_string();

    Some(Classification::compound_compilation(
        leading_classification.kind?,
        leading_classification.confidence,
        "compilation command with benign trailing redirect/pipe/background",
        String::new(),
        extracted,
    ))
}

/// Kind of structural boundary found at the top level of a command.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum BoundaryKind {
    /// A single `|` pipe.
    Pipe,
    /// A standalone trailing `&` (backgrounding).
    Background,
    /// A `>` / `>>` output file redirect.
    OutputRedirect,
    /// A `<` input file redirect (always rejected for offload).
    InputRedirect,
}

struct StructuralBoundary {
    byte_pos: usize,
    kind: BoundaryKind,
}

/// Find the first top-level (unquoted) structural boundary in `cmd`, skipping
/// fd-to-fd redirects like `2>&1` / `>&2` which are NOT boundaries (they belong
/// to the preceding command and are safe to offload inline).
fn find_first_structural_boundary(cmd: &str) -> Option<StructuralBoundary> {
    let bytes = cmd.as_bytes();
    let len = bytes.len();
    let mut in_single = false;
    let mut in_double = false;
    let mut escaped = false;
    let mut i = 0;

    while i < len {
        let b = bytes[i];
        if escaped {
            escaped = false;
            i += 1;
            continue;
        }
        if b == b'\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }
        if b == b'\'' && !in_double {
            in_single = !in_single;
            i += 1;
            continue;
        }
        if b == b'"' && !in_single {
            in_double = !in_double;
            i += 1;
            continue;
        }
        if in_single || in_double {
            i += 1;
            continue;
        }

        match b {
            b'|' => {
                // `||` is chaining and is handled/rejected by the caller's guard,
                // but be defensive.
                if i + 1 < len && bytes[i + 1] == b'|' {
                    return None;
                }
                return Some(StructuralBoundary {
                    byte_pos: i,
                    kind: BoundaryKind::Pipe,
                });
            }
            b'&' => {
                // `&&` is chaining (rejected by caller). A standalone `&` is
                // backgrounding. `2>&1` / `>&2` are fd dups: prev byte is `>`.
                if i + 1 < len && bytes[i + 1] == b'&' {
                    return None;
                }
                let prev = if i > 0 { bytes[i - 1] } else { 0 };
                if prev == b'>' {
                    // part of an fd-to-fd redirect, not a boundary
                    i += 1;
                    continue;
                }
                return Some(StructuralBoundary {
                    byte_pos: i,
                    kind: BoundaryKind::Background,
                });
            }
            b'>' => {
                // Skip fd-to-fd redirects `>&` (e.g. 2>&1) — not a boundary.
                if i + 1 < len && bytes[i + 1] == b'&' {
                    i += 2;
                    if i < len && bytes[i].is_ascii_digit() {
                        i += 1;
                    }
                    continue;
                }
                // `>(` process substitution — leave for Tier 1 to reject.
                if i + 1 < len && bytes[i + 1] == b'(' {
                    return None;
                }
                return Some(StructuralBoundary {
                    byte_pos: i,
                    kind: BoundaryKind::OutputRedirect,
                });
            }
            b'<' => {
                if i + 1 < len && bytes[i + 1] == b'(' {
                    return None;
                }
                return Some(StructuralBoundary {
                    byte_pos: i,
                    kind: BoundaryKind::InputRedirect,
                });
            }
            _ => {}
        }
        i += 1;
    }
    None
}

/// Validate that the trailing structure (operator + remainder) is benign for
/// offloading, given the kind of the first boundary.
fn suffix_is_benign(kind: BoundaryKind, suffix: &str) -> bool {
    // The suffix must not itself contain a further top-level boundary that we
    // haven't validated (e.g. `> log | tee x` or `| head | build`). We allow at
    // most ONE structural stage by requiring that, after the first boundary,
    // the remainder has no additional unquoted boundary — EXCEPT fd-to-fd dups.
    match kind {
        BoundaryKind::InputRedirect => false,
        BoundaryKind::Background => {
            // `cmd &` — only valid if `&` is the LAST meaningful token.
            // Reject `cmd & other` (a second command after backgrounding).
            let after = suffix.trim_start_matches('&').trim();
            after.is_empty()
        }
        BoundaryKind::OutputRedirect => {
            // `> file 2>&1`, `>> file`, `> a.log` — must not contain a further
            // pipe / background / input redirect / chaining.
            !suffix_has_disallowed_followup(suffix)
        }
        BoundaryKind::Pipe => {
            // `| <pager> ...` — the RHS command word must be a benign pager and
            // there must be no further pipe stage or chaining.
            let rhs = suffix.trim_start_matches('|').trim();
            if rhs.is_empty() {
                return false;
            }
            let rhs_cmd = rhs.split_whitespace().next().unwrap_or("");
            let rhs_base = rhs_cmd.rsplit('/').next().unwrap_or(rhs_cmd);
            if !BENIGN_PAGER_COMMANDS.contains(&rhs_base) {
                return false;
            }
            !suffix_has_disallowed_followup(rhs)
        }
    }
}

/// Returns true if `s` contains ANY further disallowed top-level structural
/// operator (a pipe, backgrounding, or input redirect) anywhere after the
/// initial benign stage. Output redirects (`> file`, `2>&1`) are allowed to
/// repeat (e.g. `> out.log 2>&1`), but a pipe/background/input redirect mixed
/// into the suffix means it is more than a single benign stage and must not be
/// offloaded.
///
/// We scan the WHOLE string (not just the first boundary) so forms like
/// `> a.log < in.txt` — where the dangerous `< in.txt` follows a benign `>` —
/// are correctly rejected.
fn suffix_has_disallowed_followup(s: &str) -> bool {
    let mut rest = s;
    loop {
        match find_first_structural_boundary(rest) {
            Some(b) => {
                if matches!(
                    b.kind,
                    BoundaryKind::Pipe | BoundaryKind::Background | BoundaryKind::InputRedirect
                ) {
                    return true;
                }
                // Benign output redirect: advance past it and keep scanning the
                // remainder for any disallowed operator.
                let next = b.byte_pos + 1;
                if next >= rest.len() {
                    return false;
                }
                rest = &rest[next..];
            }
            None => return false,
        }
    }
}

/// Split a command on && only (simpler than split_multi_command).
/// Returns None if no && found.
fn split_and_chain(cmd: &str) -> Option<Vec<&str>> {
    if !cmd.contains("&&") {
        return None;
    }

    let mut segments = Vec::new();
    let mut current_start = 0;
    let mut in_single = false;
    let mut in_double = false;
    let mut escaped = false;
    let bytes = cmd.as_bytes();
    let mut i = 0;

    while i < bytes.len() {
        let b = bytes[i];

        if escaped {
            escaped = false;
            i += 1;
            continue;
        }

        // POSIX: backslash is LITERAL inside single quotes; only honor it as an
        // escape when not in a single-quoted span, or the next `'` is wrongly
        // swallowed and the quote stays "open", hiding an exposed operator
        // (bd-review-singlequote-escape).
        if b == b'\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }

        if b == b'\'' && !in_double {
            in_single = !in_single;
        } else if b == b'"' && !in_single {
            in_double = !in_double;
        } else if !in_single
            && !in_double
            && b == b'&'
            && i + 1 < bytes.len()
            && bytes[i + 1] == b'&'
        {
            let segment = &cmd[current_start..i];
            let trimmed = segment.trim();
            if !trimmed.is_empty() {
                segments.push(trimmed);
            }
            current_start = i + 2;
            i += 1; // Skip second '&'
        }

        i += 1;
    }

    // Add final segment
    let final_segment = &cmd[current_start..];
    let trimmed = final_segment.trim();
    if !trimmed.is_empty() {
        segments.push(trimmed);
    }

    if segments.len() > 1 {
        Some(segments)
    } else {
        None
    }
}

/// Split a multi-command string on `&&`, `||`, and `;` while respecting quotes.
///
/// Returns `None` if no multi-command operators are found.
/// Returns `Some(segments)` where each segment is a trimmed sub-command.
#[allow(dead_code)] // May be used for future enhancements
fn split_multi_command(cmd: &str) -> Option<Vec<&str>> {
    // Quick check: if no operators, return None early
    if !cmd.contains("&&") && !cmd.contains("||") && !cmd.contains(';') {
        return None;
    }

    let mut segments = Vec::new();
    let mut current_start = 0;
    let mut in_single = false;
    let mut in_double = false;
    let mut escaped = false;
    let chars: Vec<char> = cmd.chars().collect();
    let mut i = 0;

    while i < chars.len() {
        let c = chars[i];

        if escaped {
            escaped = false;
            i += 1;
            continue;
        }

        // POSIX: backslash is LITERAL inside single quotes (see
        // bd-review-singlequote-escape); only treat it as an escape elsewhere.
        if c == '\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }

        if c == '\'' && !in_double {
            in_single = !in_single;
        } else if c == '"' && !in_single {
            in_double = !in_double;
        } else if !in_single && !in_double {
            // Check for operators
            if c == ';' {
                let segment = &cmd[current_start..byte_index(&chars, i)];
                let trimmed = segment.trim();
                if !trimmed.is_empty() {
                    segments.push(trimmed);
                }
                current_start = byte_index(&chars, i + 1);
            } else if c == '&' && i + 1 < chars.len() && chars[i + 1] == '&' {
                let segment = &cmd[current_start..byte_index(&chars, i)];
                let trimmed = segment.trim();
                if !trimmed.is_empty() {
                    segments.push(trimmed);
                }
                current_start = byte_index(&chars, i + 2);
                i += 1; // Skip second '&'
            } else if c == '|' && i + 1 < chars.len() && chars[i + 1] == '|' {
                let segment = &cmd[current_start..byte_index(&chars, i)];
                let trimmed = segment.trim();
                if !trimmed.is_empty() {
                    segments.push(trimmed);
                }
                current_start = byte_index(&chars, i + 2);
                i += 1; // Skip second '|'
            }
        }

        i += 1;
    }

    // Add final segment
    let final_segment = &cmd[current_start..];
    let trimmed = final_segment.trim();
    if !trimmed.is_empty() {
        segments.push(trimmed);
    }

    // Only return Some if we actually split something
    if segments.len() > 1 {
        Some(segments)
    } else {
        None
    }
}

/// Convert char index to byte index for string slicing.
#[allow(dead_code)] // Reserved for future multi-command classification
fn byte_index(chars: &[char], char_idx: usize) -> usize {
    chars.iter().take(char_idx).map(|c| c.len_utf8()).sum()
}

/// Classify a multi-command string by evaluating each sub-command independently.
///
/// Returns compilation if ANY sub-command is compilation (highest confidence wins).
/// Returns non-compilation only if ALL sub-commands are non-compilation.
#[allow(dead_code)] // Reserved for future multi-command classification
fn classify_multi_command(segments: &[&str], depth: u8) -> Classification {
    let mut best_compilation: Option<Classification> = None;

    for &segment in segments {
        let result = classify_command_inner(segment, depth + 1);
        if result.is_compilation {
            let dominated = match &best_compilation {
                Some(prev) => result.confidence > prev.confidence,
                None => true,
            };
            if dominated {
                best_compilation = Some(result);
            }
        }
    }

    if let Some(compilation) = best_compilation {
        return compilation;
    }

    Classification::not_compilation("no sub-command is compilation")
}

/// Classify a shell command with detailed tier decisions for diagnostics.
pub fn classify_command_detailed(cmd: &str) -> ClassificationDetails {
    let original = cmd.to_string();
    let cmd = cmd.trim();
    let mut tiers = Vec::new();

    // Tier 0: Instant reject - empty command
    if cmd.is_empty() {
        let classification = Classification::not_compilation("empty command");
        tiers.push(ClassificationTier {
            tier: 0,
            name: Cow::Borrowed(TIER_INSTANT_REJECT),
            decision: TierDecision::Reject,
            reason: Cow::Borrowed("empty command"),
        });
        return ClassificationDetails {
            original,
            normalized: cmd.to_string(),
            tiers,
            classification,
        };
    }

    tiers.push(ClassificationTier {
        tier: 0,
        name: Cow::Borrowed(TIER_INSTANT_REJECT),
        decision: TierDecision::Pass,
        reason: Cow::Borrowed("command present"),
    });

    // Tier 0.5: Compound / wrapper / benign-suffix handling, mirroring
    // classify_command_inner(). Without this branch, diagnostics could reject a
    // command such as `cd /repo && cargo build`, `bash -c "cargo test"`, or
    // `cargo check 2>&1 | head` while the hook classifier accepts and offloads
    // it (issue #24).
    if cmd.len() < MAX_SPLIT_INPUT_LEN
        && let Some((classification, structure_reason)) = try_classify_compound_command(cmd)
            .map(|c| (c, "safe compound command with compilation suffix"))
            .or_else(|| {
                try_classify_wrapped_command(cmd)
                    .map(|c| (c, "shell -c wrapper with compilation command"))
            })
            .or_else(|| {
                try_classify_benign_suffix_command(cmd).map(|c| {
                    (
                        c,
                        "compilation command with benign trailing redirect/pipe/background",
                    )
                })
            })
    {
        let normalized = classification
            .extracted_command
            .clone()
            .unwrap_or_else(|| cmd.to_string());

        tiers.push(ClassificationTier {
            tier: 1,
            name: Cow::Borrowed(TIER_STRUCTURE_ANALYSIS),
            decision: TierDecision::Pass,
            reason: Cow::Borrowed(structure_reason),
        });
        tiers.push(ClassificationTier {
            tier: 2,
            name: Cow::Borrowed(TIER_KEYWORD_FILTER),
            decision: TierDecision::Pass,
            reason: Cow::Borrowed("keyword present in extracted command"),
        });
        tiers.push(ClassificationTier {
            tier: 3,
            name: Cow::Borrowed(TIER_NEVER_INTERCEPT),
            decision: TierDecision::Pass,
            reason: Cow::Borrowed("extracted command passed never-intercept checks"),
        });
        tiers.push(ClassificationTier {
            tier: 4,
            name: Cow::Borrowed(TIER_FULL_CLASSIFICATION),
            decision: TierDecision::Pass,
            reason: classification.reason.clone(),
        });

        return ClassificationDetails {
            original,
            normalized,
            tiers,
            classification,
        };
    }

    // Tier 1: Structure analysis
    if let Some(reason) = check_structure(cmd) {
        let classification = Classification::not_compilation(reason);
        tiers.push(ClassificationTier {
            tier: 1,
            name: Cow::Borrowed(TIER_STRUCTURE_ANALYSIS),
            decision: TierDecision::Reject,
            reason: Cow::Borrowed(reason),
        });
        return ClassificationDetails {
            original,
            normalized: cmd.to_string(),
            tiers,
            classification,
        };
    }

    tiers.push(ClassificationTier {
        tier: 1,
        name: Cow::Borrowed(TIER_STRUCTURE_ANALYSIS),
        decision: TierDecision::Pass,
        reason: Cow::Borrowed("no pipes/redirects/backgrounding"),
    });

    // Normalize command for Tier 2, 3, and 4.
    let normalized_cow = normalize_command(cmd);
    let normalized = normalized_cow.as_ref();

    // Tier 2: command-word compilation filter.
    if !starts_with_compilation_command(normalized) {
        let classification = Classification::not_compilation("no compilation keyword");
        tiers.push(ClassificationTier {
            tier: 2,
            name: Cow::Borrowed(TIER_KEYWORD_FILTER),
            decision: TierDecision::Reject,
            reason: Cow::Borrowed("no compilation keyword"),
        });
        return ClassificationDetails {
            original,
            normalized: normalized.to_string(),
            tiers,
            classification,
        };
    }

    tiers.push(ClassificationTier {
        tier: 2,
        name: Cow::Borrowed(TIER_KEYWORD_FILTER),
        decision: TierDecision::Pass,
        reason: Cow::Borrowed("keyword present"),
    });

    // Tier 3: Negative pattern check - never intercept these
    for pattern in NEVER_INTERCEPT {
        if let Some(rest) = normalized.strip_prefix(pattern)
            && (rest.is_empty() || rest.starts_with(' '))
        {
            let reason: Cow<'static, str> =
                Cow::Owned(format!("matches never-intercept: {pattern}"));
            let classification = Classification::not_compilation(reason.clone());
            tiers.push(ClassificationTier {
                tier: 3,
                name: Cow::Borrowed(TIER_NEVER_INTERCEPT),
                decision: TierDecision::Reject,
                reason,
            });
            return ClassificationDetails {
                original,
                normalized: normalized.to_string(),
                tiers,
                classification,
            };
        }
    }

    tiers.push(ClassificationTier {
        tier: 3,
        name: Cow::Borrowed(TIER_NEVER_INTERCEPT),
        decision: TierDecision::Pass,
        reason: Cow::Borrowed("no never-intercept match"),
    });

    // Tier 4: Full classification
    let classification = classify_full(normalized);
    let decision = if classification.is_compilation {
        TierDecision::Pass
    } else {
        TierDecision::Reject
    };
    tiers.push(ClassificationTier {
        tier: 4,
        name: Cow::Borrowed(TIER_FULL_CLASSIFICATION),
        decision,
        reason: classification.reason.clone(),
    });

    ClassificationDetails {
        original,
        normalized: normalized.to_string(),
        tiers,
        classification,
    }
}

/// Whether a `-flag VALUE` form for `wrapper` consumes the following token as
/// its value (so the value isn't mistaken for the wrapped command word).
/// Only the space-separated forms are listed; `=`-joined and space-attached
/// forms (`--adjustment=10`, `-n10`) carry their value in the same token.
fn wrapper_flag_takes_value(wrapper: &str, flag: &str) -> bool {
    match wrapper {
        "env" => matches!(flag, "-u" | "--unset"),
        "nice" => matches!(flag, "-n" | "--adjustment"),
        "ionice" => matches!(
            flag,
            "-c" | "--class" | "-n" | "--classdata" | "-p" | "--pid"
        ),
        "taskset" => matches!(flag, "-c" | "--cpu-list" | "-p" | "--pid"),
        "chrt" => matches!(flag, "-p" | "--pid"),
        "timeout" => matches!(flag, "-s" | "--signal" | "-k" | "--kill-after"),
        _ => false,
    }
}

/// Heuristic: does `token` look like a `timeout` duration (`60`, `1.5h`, `30s`)
/// or a `chrt` priority (`10`)? Used to decide whether to skip a positional
/// value token without ever eating a real command word.
fn looks_like_duration_or_priority(token: &str) -> bool {
    token.chars().next().is_some_and(|c| c.is_ascii_digit())
}

/// Read a wrapper argument without splitting a fully quoted token. `rch exec`
/// quotes literal flags such as `-f%U` when rebuilding its shell command.
/// Mixed/unterminated quoting is left unrecognized rather than guessing where
/// the wrapped command starts.
fn split_wrapper_word(input: &str) -> Option<(&str, &str)> {
    let input = input.trim_start();
    let first = input.chars().next()?;
    if matches!(first, '\'' | '"') {
        let end = input[1..].find(first)? + 1;
        let word = &input[1..end];
        let rest = &input[end + 1..];
        if !rest.is_empty() && !rest.starts_with(char::is_whitespace) {
            return None;
        }
        // Escaped quotes and expansions need shell parsing; do not interpret
        // them as literal flag names here.
        if first == '"' && word.contains(['\\', '$', '`']) {
            return None;
        }
        Some((word, rest.trim_start()))
    } else {
        let (word, rest) = input.split_once(char::is_whitespace).unwrap_or((input, ""));
        if word.contains(['\'', '"', '\\']) {
            return None;
        }
        Some((word, rest.trim_start()))
    }
}

/// Normalize a command by stripping common wrappers (sudo, time, env, etc.)
pub fn normalize_command(cmd: &str) -> Cow<'_, str> {
    let mut result = cmd.trim();

    // Strip common command prefixes/wrappers
    // Note: We match the command name, then ensure it's followed by whitespace
    let wrappers = [
        "sudo", "env", "time", "timeout", "nice", "ionice", "chrt", "strace", "ltrace", "perf",
        "taskset", "numactl",
    ];

    loop {
        let mut changed = false;
        for wrapper in wrappers {
            if let Some(rest) = result.strip_prefix(wrapper) {
                // Must be followed by whitespace or end of string
                // (e.g., "sudo" matches "sudo ls", but not "sudoku"; "time"
                // must not swallow "timeout" — guarded by this whitespace check)
                if rest.is_empty() || rest.starts_with(char::is_whitespace) {
                    result = rest.trim_start();
                    changed = true;

                    // Strip flags that might follow the wrapper (e.g., "time -v", "sudo -E").
                    // We heuristically strip any token starting with '-' until we find a non-flag.
                    // For value-taking flags (e.g. `nice -n 10`, `taskset -c 0-3`, `env -u VAR`)
                    // we must ALSO consume the following value token, or it is left as the
                    // command word and a real `cargo build` is misclassified as non-compilation
                    // (silent local fallback). Space-attached forms (`-n10`, `--adjustment=10`)
                    // carry their value in the same token and need no extra consume.
                    while let Some((flag, rest_after_flag)) = split_wrapper_word(result) {
                        if !flag.starts_with('-') {
                            break;
                        }
                        result = rest_after_flag;

                        if wrapper_flag_takes_value(wrapper, flag) {
                            let Some((_value, rest_after_value)) = split_wrapper_word(result)
                            else {
                                break;
                            };
                            result = rest_after_value;
                        }
                    }

                    // Positional value wrappers: `timeout <duration> cmd` and
                    // `chrt <prio> cmd` carry a bare (non-flag) value token before
                    // the command. Skip exactly one such token when it looks like a
                    // duration/priority (leading digit), so we never eat the real
                    // command word (e.g. `timeout cargo build` keeps `cargo build`).
                    if matches!(wrapper, "timeout" | "chrt")
                        && let Some((first, after_first)) = result.split_once(char::is_whitespace)
                        && !first.starts_with('-')
                        && looks_like_duration_or_priority(first)
                    {
                        result = after_first.trim_start();
                    }
                }
            }
        }

        // Handle env VAR=val syntax
        // Logic: if result starts with VAR=val (potentially quoted), strip it.
        // We need to parse the first token respecting quotes.
        let chars = result.chars();
        let mut token_len = 0;
        let mut in_quote = None; // None, Some('\''), Some('"')
        let mut escaped = false;
        let mut has_equals = false;
        let mut has_space = false;

        for c in chars {
            if escaped {
                escaped = false;
                token_len += c.len_utf8();
                continue;
            }

            if c == '\\' {
                escaped = true;
                token_len += c.len_utf8();
                continue;
            }

            if let Some(q) = in_quote {
                if c == q {
                    in_quote = None;
                } else if c == '=' {
                    has_equals = true;
                }
                token_len += c.len_utf8();
            } else if c == '"' || c == '\'' {
                in_quote = Some(c);
                token_len += c.len_utf8();
            } else if c.is_whitespace() {
                has_space = true;
                break;
            } else {
                if c == '=' {
                    has_equals = true;
                }
                token_len += c.len_utf8();
            }
        }

        if has_equals && in_quote.is_none() && has_space {
            // It was a complete token with an equals sign followed by space.
            // We assume it's an env var and strip it.
            result = result[token_len..].trim_start();
            changed = true;
        }

        // Strip absolute paths: /usr/bin/cargo -> cargo
        // We assume the command is the first word
        if result.starts_with('/') {
            if let Some(space_idx) = result.find(' ') {
                let cmd_part = &result[..space_idx];
                if let Some(last_slash) = cmd_part.rfind('/') {
                    // Result becomes substring starting after the last slash of the command word
                    result = &result[last_slash + 1..];
                    changed = true;
                }
            } else {
                // Single word command
                if let Some(last_slash) = result.rfind('/') {
                    result = &result[last_slash + 1..];
                    changed = true;
                }
            }
        }

        if !changed {
            break;
        }
    }

    if result.eq(cmd) {
        Cow::Borrowed(cmd)
    } else {
        Cow::Owned(result.to_string())
    }
}

/// Check if a command contains file redirects (NOT fd-to-fd redirects like `2>&1`).
///
/// Returns true for file redirects: `> file`, `>> file`, `2> file`, `&> file`
/// Returns false for fd-to-fd redirects: `2>&1`, `>&2`, `1>&2`
/// Also returns true for input redirects: `< file`
///
/// This is used by `try_classify_compound_command` which needs a quick text-level
/// check before doing more expensive parsing.
fn has_file_redirect(cmd: &str) -> bool {
    let bytes = cmd.as_bytes();
    let len = bytes.len();
    let mut in_single = false;
    let mut in_double = false;
    let mut escaped = false;
    let mut i = 0;

    while i < len {
        let b = bytes[i];

        if escaped {
            escaped = false;
            i += 1;
            continue;
        }
        // POSIX: backslash is LITERAL inside single quotes; only honor it as an
        // escape when not in a single-quoted span, or the next `'` is wrongly
        // swallowed and the quote stays "open", hiding an exposed operator
        // (bd-review-singlequote-escape).
        if b == b'\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }
        match b {
            b'\'' if !in_double => {
                in_single = !in_single;
            }
            b'"' if !in_single => {
                in_double = !in_double;
            }
            b'>' if !in_single && !in_double => {
                // Check if this is a fd-to-fd redirect (N>&M or >&N)
                if i + 1 < len && bytes[i + 1] == b'&' {
                    // >&N or N>&M — fd-to-fd, skip
                    i += 2; // skip > and &
                    // skip optional digit
                    if i < len && bytes[i].is_ascii_digit() {
                        i += 1;
                    }
                    continue;
                }
                // >( is process substitution, not a file redirect per se,
                // but it's caught by the subshell check separately
                if i + 1 < len && bytes[i + 1] == b'(' {
                    i += 1;
                    continue;
                }
                return true; // File redirect: > file, >> file, N> file
            }
            b'<' if !in_single && !in_double => {
                // <( is process substitution, caught separately
                if i + 1 < len && bytes[i + 1] == b'(' {
                    i += 1;
                    continue;
                }
                return true; // Input redirect: < file
            }
            _ => {}
        }
        i += 1;
    }
    false
}

/// Check command structure for patterns that shouldn't be intercepted.
///
/// Performance: single-pass O(n) state machine instead of 11+ separate scans.
/// This is critical because structure analysis runs on EVERY command.
///
/// Detection priority (matches original behavior):
/// 1. Embedded newlines (security - command injection)
/// 2. Standalone & (backgrounding)
/// 3. Single | pipe (not ||)
/// 4. Subshell ( or >( or <(
/// 5. Output redirection >
/// 6. Input redirection <
/// 7. Semicolon ;
/// 8. && chaining
/// 9. || chaining
/// 10. Subshell capture $( or backtick
fn check_structure(cmd: &str) -> Option<&'static str> {
    let bytes = cmd.as_bytes();
    let len = bytes.len();

    let mut in_single = false;
    let mut in_double = false;
    let mut escaped = false;

    // Track what we find (in priority order, lower = higher priority)
    // Using Option to track if found, with priority encoded by check order
    let mut found_backgrounded = false;
    let mut found_piped = false;
    let mut found_subshell = false;
    let mut found_output_redirect = false;
    let mut found_input_redirect = false;
    let mut found_semicolon = false;
    let mut found_and_chain = false;
    let mut found_or_chain = false;
    let mut found_subshell_capture = false;

    let mut i = 0;
    while i < len {
        let b = bytes[i];

        // Handle escape sequences
        if escaped {
            escaped = false;
            i += 1;
            continue;
        }
        // POSIX: backslash is LITERAL inside single quotes; only honor it as an
        // escape when not in a single-quoted span, or the next `'` is wrongly
        // swallowed and the quote stays "open", hiding an exposed operator
        // (bd-review-singlequote-escape).
        if b == b'\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }

        // Handle quote state transitions
        if b == b'\'' && !in_double {
            in_single = !in_single;
            i += 1;
            continue;
        }
        if b == b'"' && !in_single {
            in_double = !in_double;
            i += 1;
            continue;
        }

        // Skip quoted content
        if in_single || in_double {
            i += 1;
            continue;
        }

        // Check for problematic characters/patterns (unquoted)
        match b {
            // Embedded newlines - return immediately (highest priority, security issue)
            b'\n' | b'\r' => return Some("contains embedded newline"),

            // Ampersand: check for && vs standalone &
            b'&' => {
                if i + 1 < len && bytes[i + 1] == b'&' {
                    found_and_chain = true;
                    i += 1; // Skip second &
                } else {
                    // Check for redirection patterns like 2>&1 or &>
                    let prev = if i > 0 { bytes[i - 1] } else { 0 };
                    let next = if i + 1 < len { bytes[i + 1] } else { 0 };
                    if prev != b'>' && next != b'>' {
                        found_backgrounded = true;
                    }
                }
            }

            // Pipe: check for || vs single |
            b'|' => {
                if i + 1 < len && bytes[i + 1] == b'|' {
                    found_or_chain = true;
                    i += 1; // Skip second |
                } else {
                    found_piped = true;
                }
            }

            // Subshell/process substitution
            b'(' => found_subshell = true,

            // Output redirection (>( is process substitution, caught by ( check)
            // fd-to-fd redirects like 2>&1, >&2 are safe to intercept
            b'>' => {
                if i + 1 < len && bytes[i + 1] == b'(' {
                    found_subshell = true;
                } else if i + 1 < len && bytes[i + 1] == b'&' {
                    // Pattern: N>&M or >&N (fd-to-fd redirect) — safe, skip
                    // e.g. 2>&1, 1>&2, >&2
                    // Skip the '&' and any following digit
                    i += 1; // skip '&'
                    if i + 1 < len && bytes[i + 1].is_ascii_digit() {
                        i += 1; // skip digit after &
                    }
                } else if i + 1 < len && bytes[i + 1] == b'>' {
                    // Append redirect >> (to file) — NOT safe
                    found_output_redirect = true;
                    i += 1; // skip second >
                } else {
                    found_output_redirect = true;
                }
            }

            // Input redirection (<( is process substitution, caught by ( check)
            b'<' => {
                if i + 1 < len && bytes[i + 1] == b'(' {
                    found_subshell = true;
                } else {
                    found_input_redirect = true;
                }
            }

            // Semicolon chaining
            b';' => found_semicolon = true,

            // Backtick subshell capture
            b'`' => found_subshell_capture = true,

            // Dollar sign: check for $( subshell capture
            b'$' if i + 1 < len && bytes[i + 1] == b'(' => {
                found_subshell_capture = true;
            }

            _ => {}
        }

        i += 1;
    }

    // Return in priority order (matches original check_structure behavior)
    if found_backgrounded {
        return Some("backgrounded command");
    }
    // Pipe check: only if not ||
    if found_piped && !found_or_chain {
        return Some("piped command");
    }
    if found_subshell {
        return Some("subshell execution");
    }
    if found_output_redirect {
        return Some("output redirected");
    }
    if found_input_redirect {
        return Some("input redirected");
    }
    if found_semicolon {
        return Some("chained command (;)");
    }
    if found_and_chain {
        return Some("chained command (&&)");
    }
    if found_or_chain {
        return Some("chained command (||)");
    }
    if found_subshell_capture {
        return Some("subshell capture");
    }

    None
}

/// Check whether the invoked command word is one of the compilation tools.
///
/// The keyword filter runs before full classification, so it must be cheap but
/// cannot treat arbitrary arguments as commands. `normalize_command` strips
/// wrappers and environment assignments before this helper is called.
fn starts_with_compilation_command(cmd: &str) -> bool {
    let cmd = cmd.trim_start();
    COMPILATION_KEYWORDS
        .iter()
        .any(|keyword| command_word_matches(cmd, keyword))
}

fn command_word_matches(cmd: &str, keyword: &str) -> bool {
    let Some(rest) = cmd.strip_prefix(keyword) else {
        return false;
    };
    rest.is_empty() || rest.starts_with(char::is_whitespace)
}

/// Bare positional target tokens of a `make`/`ninja` command.
///
/// Skips the program name, option flags (`-x`, `--long`, combined `-j8`), the
/// value token consumed by any flag in `value_flags`, and `VAR=value`
/// assignments. This lets the maintenance-target check match WHOLE tokens
/// (`clean`, `install`, …) instead of a substring anywhere in the command, so
/// real builds like `make CFLAGS=-Iinstall/include`, `make TARGET=cleanup`,
/// `ninja build/clean_obj.o`, and `make -C install` / `ninja -C clean` (a
/// directory argument, not the target) are no longer misclassified as
/// maintenance.
fn positional_build_targets<'a>(cmd: &'a str, value_flags: &[&str]) -> Vec<&'a str> {
    let mut targets = Vec::new();
    let toks: Vec<&str> = cmd.split_whitespace().skip(1).collect();
    let mut i = 0;
    while i < toks.len() {
        let tok = toks[i];
        if value_flags.contains(&tok) {
            i += 2; // flag consumes the following token as its value
        } else if tok.starts_with('-') || tok.contains('=') {
            i += 1; // other flag (incl. combined `-j8`) or VAR=value assignment
        } else {
            targets.push(tok);
            i += 1;
        }
    }
    targets
}

/// Full classification of a command (Tier 4).
fn classify_full(cmd: &str) -> Classification {
    // Cargo commands
    if cmd.starts_with("cargo ") || cmd.eq("cargo") {
        return classify_cargo(cmd);
    }

    // `cargo-zigbuild` invoked as a standalone binary (this is what `cargo
    // zigbuild ...` execs). Note the hyphen: it does NOT match `cargo ` above.
    if cmd.starts_with("cargo-zigbuild ") || cmd.eq("cargo-zigbuild") {
        return classify_cargo_zigbuild(cmd);
    }

    if cmd.starts_with("cargo-xwin ") || cmd.eq("cargo-xwin") {
        return if is_cargo_xwin_build(cmd) {
            Classification::compilation(CompilationKind::CargoBuild, 0.95, "cargo-xwin build")
        } else {
            Classification::not_compilation("cargo-xwin subcommand not interceptable")
        };
    }

    // rustc
    if cmd.starts_with("rustc ") || cmd.eq("rustc") {
        return Classification::compilation(CompilationKind::Rustc, 0.95, "rustc invocation");
    }

    // GCC
    if cmd.starts_with("gcc ")
        && (cmd.contains(" -c ") || cmd.contains(" -o ") || cmd.contains(".c"))
    {
        return Classification::compilation(CompilationKind::Gcc, 0.90, "gcc compilation");
    }

    // G++
    if cmd.starts_with("g++ ")
        && (cmd.contains(" -c ")
            || cmd.contains(" -o ")
            || cmd.contains(".cpp")
            || cmd.contains(".cc"))
    {
        return Classification::compilation(CompilationKind::Gpp, 0.90, "g++ compilation");
    }

    // Clang
    if cmd.starts_with("clang ")
        && !cmd.starts_with("clang++ ")
        && (cmd.contains(" -c ") || cmd.contains(" -o ") || cmd.contains(".c"))
    {
        return Classification::compilation(CompilationKind::Clang, 0.90, "clang compilation");
    }

    // Clang++
    if cmd.starts_with("clang++ ")
        && (cmd.contains(" -c ")
            || cmd.contains(" -o ")
            || cmd.contains(".cpp")
            || cmd.contains(".cc"))
    {
        return Classification::compilation(CompilationKind::Clangpp, 0.90, "clang++ compilation");
    }

    // cc (standard C compiler)
    if cmd.starts_with("cc ")
        && (cmd.contains(" -c ") || cmd.contains(" -o ") || cmd.contains(".c"))
    {
        return Classification::compilation(CompilationKind::Gcc, 0.85, "cc compilation");
    }

    // c++ (standard C++ compiler)
    if cmd.starts_with("c++ ")
        && (cmd.contains(" -c ")
            || cmd.contains(" -o ")
            || cmd.contains(".cpp")
            || cmd.contains(".cc"))
    {
        return Classification::compilation(CompilationKind::Gpp, 0.85, "c++ compilation");
    }

    // Make
    if cmd.starts_with("make") && (cmd.eq("make") || cmd.starts_with("make ")) {
        // Don't intercept "make clean", "make install", etc. — but match them as
        // whole TARGET tokens, not as a substring anywhere. A `contains` check
        // rejected real builds like "make CFLAGS=-Iinstall/include" and
        // "make TARGET=cleanup" as maintenance.
        const MAKE_VALUE_FLAGS: [&str; 8] = [
            "-f",
            "-C",
            "-I",
            "-o",
            "-W",
            "--file",
            "--directory",
            "--include-dir",
        ];
        const MAKE_MAINTENANCE_TARGETS: [&str; 4] = ["clean", "install", "distclean", "uninstall"];
        let is_maintenance = positional_build_targets(cmd, &MAKE_VALUE_FLAGS)
            .iter()
            .any(|target| MAKE_MAINTENANCE_TARGETS.contains(target));
        if is_maintenance {
            return Classification::not_compilation("make maintenance command");
        }
        return Classification::compilation(CompilationKind::Make, 0.85, "make build");
    }

    // CMake build (only when cmake is the invoked command)
    if cmd.starts_with("cmake ") || cmd.eq("cmake") {
        let mut tokens = cmd.split_whitespace();
        let _ = tokens.next(); // "cmake"
        if tokens.any(|token| token.eq("--build") || token.starts_with("--build=")) {
            return Classification::compilation(CompilationKind::CmakeBuild, 0.90, "cmake --build");
        }
    }

    // Ninja
    if cmd.starts_with("ninja") && (cmd.eq("ninja") || cmd.starts_with("ninja ")) {
        // Match the `-t clean` tool form and a whole-token `clean` target — not
        // the substring "clean" anywhere ("ninja build/clean_obj.o" is a real
        // build, and "ninja -C clean" cleans a directory argument).
        const NINJA_VALUE_FLAGS: [&str; 8] = ["-C", "-f", "-j", "-k", "-l", "-d", "-t", "-w"];
        let raw: Vec<&str> = cmd.split_whitespace().collect();
        let is_clean_tool = raw.windows(2).any(|w| w[0] == "-t" && w[1] == "clean");
        let is_clean_target = positional_build_targets(cmd, &NINJA_VALUE_FLAGS).contains(&"clean");
        if is_clean_tool || is_clean_target {
            return Classification::not_compilation("ninja clean");
        }
        return Classification::compilation(CompilationKind::Ninja, 0.90, "ninja build");
    }

    // Meson (only when meson is the invoked command)
    if cmd.starts_with("meson ") || cmd.eq("meson") {
        let mut tokens = cmd.split_whitespace();
        let _ = tokens.next(); // "meson"
        let mut subcommand = None;
        for token in tokens {
            if token.starts_with('-') {
                continue;
            }
            subcommand = Some(token);
            break;
        }
        if matches!(subcommand, Some("compile")) {
            return Classification::compilation(CompilationKind::Meson, 0.85, "meson compile");
        }
    }

    // Nix commands (the `nix` multi-tool and the legacy `nix-build`).
    // Only build-like, NON-interactive, non-mutating invocations are offloaded;
    // classify_nix uses an allowlist so everything else falls back to local.
    if cmd.eq("nix-build")
        || cmd.starts_with("nix-build ")
        || cmd.eq("nix")
        || cmd.starts_with("nix ")
    {
        return classify_nix(cmd);
    }

    // Bun commands
    let mut tokens = cmd.split_whitespace();
    if tokens.next().is_some_and(|token| token.eq("bun")) {
        match tokens.next() {
            Some("test") => {
                // Check for --watch flag - don't intercept interactive mode
                // Clone the iterator to check remaining args
                if tokens.any(|a| a.eq("-w") || a.eq("--watch")) {
                    return Classification::not_compilation(
                        "bun test --watch is interactive (not intercepted)",
                    );
                }
                return Classification::compilation(
                    CompilationKind::BunTest,
                    0.95,
                    "bun test command",
                );
            }
            Some("typecheck") => {
                // Check for --watch flag - don't intercept interactive mode
                if tokens.any(|a| a.eq("-w") || a.eq("--watch")) {
                    return Classification::not_compilation(
                        "bun typecheck --watch is interactive (not intercepted)",
                    );
                }
                return Classification::compilation(
                    CompilationKind::BunTypecheck,
                    0.95,
                    "bun typecheck command",
                );
            }
            Some("x") => {
                // bun x (alias for bunx - package runner)
                // NOT intercepted - similar to npx, runs arbitrary packages
                return Classification::not_compilation("bun x runs arbitrary packages");
            }
            _ => {}
        }
    }

    // Go commands
    if cmd.starts_with("go ") {
        return classify_go(cmd);
    }

    // TypeScript: `tsc ...` and `npx tsc ...`.
    //
    // `npx` is not a normalize_command wrapper (it can run arbitrary packages),
    // so match it explicitly here rather than stripping it globally.
    if let Some(rest) = cmd
        .strip_prefix("tsc ")
        .or_else(|| cmd.strip_prefix("npx tsc "))
    {
        return classify_tsc(rest);
    }

    Classification::not_compilation("no matching pattern")
}

/// Classify `tsc` / `npx tsc` invocations.
///
/// Only `--noEmit` typechecks are offloaded. An emitting `tsc` run writes `.js`
/// / `.d.ts` / `.tsbuildinfo` into the local tree, and these kinds are
/// stream-only (no artifact sync-back), so offloading an emitting run would
/// return exit 0 with no output files — a silent correctness bug. Emitting runs
/// stay local.
///
/// `args` is the command with the leading `tsc ` / `npx tsc ` already stripped.
fn classify_tsc(args: &str) -> Classification {
    let tokens = args.split_whitespace();
    let mut no_emit = false;
    for token in tokens {
        // --watch is interactive and never terminates; never intercept.
        if token.eq("-w") || token.eq("--watch") || token.eq("--watchFile") {
            return Classification::not_compilation("tsc --watch is interactive (not intercepted)");
        }
        // tsc's flag parsing is case-insensitive (--noemit == --noEmit).
        if token.eq_ignore_ascii_case("--noemit") {
            no_emit = true;
        }
    }

    if !no_emit {
        return Classification::not_compilation(
            "tsc without --noEmit emits output files locally (not intercepted)",
        );
    }

    Classification::compilation(CompilationKind::Tsc, 0.95, "tsc --noEmit typecheck")
}

/// Classify `go` subcommands.
///
/// Only `build` (without `-o`), `test`, and `vet` are offloaded. Everything else
/// is either local-state-mutating or trivially fast and is listed in
/// [`NEVER_INTERCEPT`]; this function is the second line of defence.
///
/// `go build -o <file>` is deliberately NOT offloaded: it writes a binary the
/// caller expects to find on the local filesystem, and Go kinds are stream-only
/// (no artifact sync-back). Offloading it would report success while leaving no
/// binary behind. Plain `go build ./...` writes nothing (it is a compile check),
/// so exit status is the entire payload and it is safe to run remotely.
fn classify_go(cmd: &str) -> Classification {
    let mut tokens = cmd.split_whitespace();
    // Skip the leading "go".
    tokens.next();

    let subcommand = match tokens.next() {
        Some(sub) => sub,
        None => return Classification::not_compilation("bare `go` is not a compilation command"),
    };

    // Remaining args, used for flag checks below.
    let args: Vec<&str> = tokens.collect();

    match subcommand {
        "build" => {
            // `-o <file>` (or `-o=<file>`) emits a binary locally — keep it local.
            if args
                .iter()
                .any(|a| a.eq(&"-o") || a.starts_with("-o=") || a.eq(&"--output"))
            {
                return Classification::not_compilation(
                    "go build -o emits a local binary (not intercepted)",
                );
            }
            Classification::compilation(CompilationKind::GoBuild, 0.95, "go build command")
        }
        "test" => {
            // `-exec` runs an arbitrary local wrapper binary; keep it local.
            if args
                .iter()
                .any(|a| a.eq(&"-exec") || a.starts_with("-exec="))
            {
                return Classification::not_compilation(
                    "go test -exec runs a local wrapper (not intercepted)",
                );
            }
            // `-c` compiles the test binary to disk instead of running it.
            if args.iter().any(|a| a.eq(&"-c")) {
                return Classification::not_compilation(
                    "go test -c emits a local test binary (not intercepted)",
                );
            }
            Classification::compilation(CompilationKind::GoTest, 0.95, "go test command")
        }
        "vet" => Classification::compilation(CompilationKind::GoVet, 0.95, "go vet command"),
        _ => Classification::not_compilation("go subcommand is not a compilation command"),
    }
}

/// Whether Cargo will build and verify a package archive without publishing it.
///
/// Kept separate from the protocol kind so the client can use the existing
/// `CargoBuild` worker contract and return the archive that Cargo verified.
/// Unknown options, shell expansion/quoting, and argument separators are
/// declined: a token that merely occurs inside an option value must never
/// authorize offloading a real `cargo publish` invocation.
pub fn is_cargo_package_verification(command: &str) -> bool {
    let normalized = normalize_command(command);
    let cmd = normalized.as_ref();
    if check_structure(cmd).is_some() || cmd.contains(['\'', '"', '\\', '$', '`']) {
        return false;
    }

    let mut tokens = cmd.split_whitespace();
    if tokens.next() != Some("cargo") {
        return false;
    }

    let mut subcommand = None;
    let mut dry_run = false;
    const VALUE_FLAGS: &[&str] = &[
        "--index",
        "--registry",
        "--token",
        "--color",
        "--config",
        "-Z",
        "-C",
        "-p",
        "--package",
        "--exclude",
        "-F",
        "--features",
        "-j",
        "--jobs",
        "--target",
        "--target-dir",
        "-m",
        "--manifest-path",
        "--lockfile-path",
        "--message-format",
    ];

    while let Some(token) = tokens.next() {
        if subcommand.is_none() && token.starts_with('+') {
            continue;
        }
        if matches!(token, "package" | "publish") && subcommand.is_none() {
            subcommand = Some(token);
            continue;
        }
        if VALUE_FLAGS.contains(&token) {
            if tokens.next().is_none_or(|value| value.starts_with('-')) {
                return false;
            }
            continue;
        }
        if let Some((flag, value)) = token.split_once('=')
            && VALUE_FLAGS.contains(&flag)
            && !value.is_empty()
        {
            continue;
        }
        if ["-j", "-p", "-F", "-m", "-Z"]
            .iter()
            .any(|flag| token.starts_with(flag) && token.len() > flag.len())
        {
            continue;
        }
        match token {
            "--dry-run" | "-n" => dry_run = true,
            "--workspace"
            | "--allow-dirty"
            | "--no-metadata"
            | "--exclude-lockfile"
            | "--all-features"
            | "--no-default-features"
            | "--keep-going"
            | "--locked"
            | "--offline"
            | "--frozen"
            | "--verbose"
            | "-v"
            | "-vv"
            | "-vvv"
            | "--quiet"
            | "-q" => {}
            // Includes --no-verify, --list/-l, --help/-h and --. Reject unknown
            // value-taking flags rather than mistaking their value for -n.
            _ => return false,
        }
    }

    matches!(subcommand, Some("package")) || (subcommand == Some("publish") && dry_run)
}

/// Recognize the explicit cargo-xwin build entry points, without treating a
/// mention in a Cargo option value as permission to relax the native MSVC gate.
/// The worker must still have the requested Rust target, cargo-xwin and its SDK.
/// Non-build commands (including cache mutation and environment inspection) are
/// deliberately outside this offload surface.
#[must_use]
pub fn is_cargo_xwin_build(command: &str) -> bool {
    let normalized = normalize_command(command);
    let cmd = normalized.as_ref();
    if check_structure(cmd).is_some() || cmd.contains(['\'', '"', '\\', '$', '`']) {
        return false;
    }
    let mut tokens = cmd.split_whitespace();
    match tokens.next() {
        Some("cargo-xwin") => {
            let mut subcommand = tokens.next();
            if subcommand == Some("xwin") {
                subcommand = tokens.next();
            }
            if subcommand != Some("build") {
                return false;
            }
        }
        Some("cargo") => loop {
            match tokens.next() {
                Some("xwin") => {
                    if tokens.next() != Some("build") {
                        return false;
                    }
                    break;
                }
                Some("--color" | "--config" | "-Z" | "-C") => {
                    if tokens.next().is_none_or(|value| value.starts_with('-')) {
                        return false;
                    }
                }
                Some("--locked" | "--offline" | "--frozen" | "-v" | "-vv" | "-q") => {}
                Some(token)
                    if token.starts_with('+')
                        || token.starts_with("--color=")
                        || token.starts_with("--config=") => {}
                _ => return false,
            }
        },
        _ => return false,
    }
    !tokens.any(|token| matches!(token, "--help" | "-h" | "--version" | "-V"))
}

/// `rch exec` rebuilds its command with `shell_words::join`, which single-quotes
/// every word containing `=`: `cargo --config=build.jobs=2 clippy` arrives as
/// `cargo '--config=build.jobs=2' clippy`. Read such a fully quoted word as its
/// content; a word with any other quoting is returned unchanged.
fn unquote_whole_word(token: &str) -> &str {
    token
        .strip_prefix('\'')
        .and_then(|rest| rest.strip_suffix('\''))
        .filter(|inner| !inner.contains('\''))
        .unwrap_or(token)
}

/// Classify cargo subcommands.
///
/// Performance: uses iterator `.nth()` to avoid Vec allocation on the hot path.
/// We only need tokens 0-3 (cargo, [+toolchain], subcommand, [nextest-subcommand]).
fn classify_cargo(cmd: &str) -> Classification {
    let mut tokens = cmd.split_whitespace();

    // Token 0: "cargo" (already validated by caller)
    let _cargo = tokens.next();

    // Skip an optional +toolchain override AND any leading global flags that can
    // precede the subcommand (e.g. `cargo --offline build`, `cargo -q test`,
    // `cargo --locked check`, `cargo --color never build`). Without this, a
    // global flag was read AS the subcommand, so a real build was misclassified
    // non-compilation and silently run locally. Value-taking global flags
    // written without `=` consume their following value token.
    const CARGO_VALUE_FLAGS: &[&str] = &["--color", "-Z", "-C", "--config"];
    let subcommand = loop {
        let Some(tok) = tokens.next().map(unquote_whole_word) else {
            return Classification::not_compilation("bare cargo command");
        };
        if tok.starts_with('+') {
            // +toolchain override — skip.
            continue;
        }
        if tok.starts_with('-') {
            if !tok.contains('=') && CARGO_VALUE_FLAGS.contains(&tok) {
                // Consume the separate value token (e.g. `--color never`).
                let _ = tokens.next();
            }
            continue;
        }
        break tok;
    };

    match subcommand {
        "build" | "b" => {
            Classification::compilation(CompilationKind::CargoBuild, 0.95, "cargo build")
        }
        "package" | "publish" => {
            if is_cargo_package_verification(cmd) {
                Classification::compilation(
                    CompilationKind::CargoBuild,
                    0.95,
                    "cargo package verification (includes build)",
                )
            } else {
                Classification::not_compilation(
                    "cargo package/publish without supported verification (never-intercept)",
                )
            }
        }
        "test" | "t" => Classification::compilation(CompilationKind::CargoTest, 0.95, "cargo test"),
        "check" | "c" => {
            Classification::compilation(CompilationKind::CargoCheck, 0.90, "cargo check")
        }
        "clippy" => Classification::compilation(CompilationKind::CargoClippy, 0.90, "cargo clippy"),
        "doc" => Classification::compilation(CompilationKind::CargoDoc, 0.85, "cargo doc"),
        "run" | "r" => {
            // cargo run compiles first, so it's a compilation command
            Classification::compilation(
                CompilationKind::CargoBuild,
                0.85,
                "cargo run (includes build)",
            )
        }
        "bench" => Classification::compilation(CompilationKind::CargoBench, 0.90, "cargo bench"),
        // `cargo zigbuild ...` — cross-compile via zig. Same offload shape as
        // `cargo build` (produces a real artifact under target/<triple>/), but
        // gated additionally on the worker having zig + cargo-zigbuild + the
        // requested rustup target (enforced downstream by needs_zig/needs_targets).
        "zigbuild" => {
            Classification::compilation(CompilationKind::CargoZigbuild, 0.95, "cargo zigbuild")
        }
        "xwin" => {
            if is_cargo_xwin_build(cmd) {
                Classification::compilation(CompilationKind::CargoBuild, 0.95, "cargo xwin build")
            } else {
                Classification::not_compilation("cargo xwin subcommand not interceptable")
            }
        }
        "nextest" => {
            // cargo nextest has subcommands: run, list, archive, show
            // Only intercept "run" - the actual test execution
            // Next token is the nextest subcommand (e.g., "run", "list")
            let Some(nextest_sub) = tokens.next() else {
                return Classification::not_compilation("bare cargo nextest without subcommand");
            };

            match nextest_sub {
                "run" | "r" => Classification::compilation(
                    CompilationKind::CargoNextest,
                    0.95,
                    "cargo nextest run",
                ),
                _ => Classification::not_compilation("cargo nextest subcommand not interceptable"),
            }
        }
        _ => Classification::not_compilation("cargo subcommand not interceptable"),
    }
}

/// Classify the standalone `cargo-zigbuild` binary (what `cargo zigbuild ...`
/// execs). Only the artifact-producing build forms are offloaded:
///
/// - `cargo-zigbuild zigbuild ...` → cross-build via zig (the canonical form)
/// - `cargo-zigbuild build ...` → same, spelled with the plain subcommand
///
/// Everything else (`check`, `test`, `run`, metadata) is declined here and runs
/// locally, matching the conservative stance in `classify_cargo` for non-build
/// forms. All accepted forms map to `CompilationKind::CargoZigbuild`.
fn classify_cargo_zigbuild(cmd: &str) -> Classification {
    let mut tokens = cmd.split_whitespace();
    // Token 0: "cargo-zigbuild" (already validated by caller).
    let _bin = tokens.next();

    // Skip an optional +toolchain override and leading global flags, mirroring
    // classify_cargo so `cargo-zigbuild +nightly zigbuild ...` still classifies.
    const CARGO_VALUE_FLAGS: &[&str] = &["--color", "-Z", "-C", "--config"];
    let subcommand = loop {
        let Some(tok) = tokens.next().map(unquote_whole_word) else {
            return Classification::not_compilation("bare cargo-zigbuild command");
        };
        if tok.starts_with('+') {
            continue;
        }
        if tok.starts_with('-') {
            if !tok.contains('=') && CARGO_VALUE_FLAGS.contains(&tok) {
                let _ = tokens.next();
            }
            continue;
        }
        break tok;
    };

    match subcommand {
        "zigbuild" | "build" | "b" => Classification::compilation(
            CompilationKind::CargoZigbuild,
            0.95,
            "cargo-zigbuild build",
        ),
        _ => Classification::not_compilation("cargo-zigbuild subcommand not interceptable"),
    }
}

/// Nix global flags (appearing BEFORE the subcommand) that consume the following
/// whitespace-separated token as their value. Without skipping the value token
/// we could read it AS the subcommand and either miss a real build or, worse,
/// misclassify — so on any ambiguity we prefer to fall back to local execution.
///
/// This is a best-effort list of the common value-taking global flags; the
/// two-value `--option NAME VALUE` form is handled separately. Space-attached
/// (`--max-jobs=4`) forms carry their value in the same token and need no skip.
const NIX_GLOBAL_VALUE_FLAGS: &[&str] = &[
    "--extra-experimental-features",
    "--experimental-features",
    "--log-format",
    "--max-jobs",
    "-j",
    "--cores",
    "--builders",
    "--store",
    "--file",
    "-f",
    "-I",
    "--include",
];

/// Classify a `nix ...` (multi-tool) or `nix-build ...` (legacy) command.
///
/// Offloadable (build-like, non-interactive, non-mutating):
///   - `nix build ...`         → build a derivation
///   - `nix-build ...`         → legacy derivation build
///   - `nix flake check`       → evaluate + build ALL flake outputs
///   - `nix develop -c <cmd>`  → run a command non-interactively in a dev shell
///   - `nix shell -c <cmd>`    → run a command non-interactively with packages
///
/// NOT offloadable (declined here → local fallback):
///   - bare `nix develop` / `nix shell`  → interactive shells
///   - `nix run` / `nix repl`            → app execution / interactive
///   - `nix flake metadata|show|update|lock|...`, `nix eval|search|...` → metadata
///   - `nix profile|registry|store|copy|...`, `nix-env`, `nix-shell` (no keyword)
///     → mutating / package management
///
/// Nix outputs never travel back (they live in the worker's `/nix/store`); these
/// are streaming, exit-status-only commands. Requires the worker to have nix +
/// a populated `/nix/store` and network access to fetch flake inputs — enforced
/// by the `RequiredRuntime::Nix` capability gate in worker selection.
fn classify_nix(cmd: &str) -> Classification {
    // Legacy `nix-build` is unconditionally a derivation build.
    if cmd.eq("nix-build") || cmd.starts_with("nix-build ") {
        return Classification::compilation(
            CompilationKind::NixBuild,
            0.9,
            "nix-build (legacy) derivation build",
        );
    }

    let mut tokens = cmd.split_whitespace();
    let _nix = tokens.next(); // "nix" (validated by caller)

    // Locate the subcommand, skipping leading global flags (and their values).
    let subcommand = loop {
        let Some(tok) = tokens.next() else {
            return Classification::not_compilation("bare nix command (no subcommand)");
        };
        if tok.starts_with('-') {
            if tok.eq("--option") {
                // `--option NAME VALUE` consumes two following tokens.
                let _ = tokens.next();
                let _ = tokens.next();
            } else if !tok.contains('=') && NIX_GLOBAL_VALUE_FLAGS.contains(&tok) {
                let _ = tokens.next();
            }
            continue;
        }
        break tok;
    };

    // Remaining tokens after the subcommand (for -c/--command and --help checks).
    let rest: Vec<&str> = tokens.collect();
    let wants_help = rest.iter().any(|t| t.eq(&"--help") || t.eq(&"-h"));
    if wants_help {
        return Classification::not_compilation("nix --help (not a build)");
    }
    let has_command_flag = rest.iter().any(|t| t.eq(&"-c") || t.eq(&"--command"));

    match subcommand {
        // `nix build` builds a derivation → offload (streaming, no artifact return).
        "build" => {
            Classification::compilation(CompilationKind::NixBuild, 0.9, "nix build derivation")
        }
        // `nix flake check` evaluates AND builds every flake output (CPU-heavy) →
        // offload. Every other `nix flake <sub>` (metadata/show/update/lock/init/
        // archive/...) is metadata or mutating and must stay local.
        "flake" => {
            let flake_sub = rest.iter().find(|t| !t.starts_with('-'));
            if flake_sub == Some(&"check") {
                Classification::compilation(
                    CompilationKind::NixBuild,
                    0.9,
                    "nix flake check (evaluates + builds all outputs)",
                )
            } else {
                Classification::not_compilation("nix flake subcommand is not a build")
            }
        }
        // `nix develop -c <cmd>` / `nix shell -c <cmd>` run a command
        // non-interactively in the environment → offload. Bare forms are
        // interactive shells and must NOT be intercepted.
        "develop" | "shell" => {
            if has_command_flag {
                let reason = if subcommand == "develop" {
                    "nix develop -c (non-interactive command in dev shell)"
                } else {
                    "nix shell -c (non-interactive command with packages)"
                };
                Classification::compilation(CompilationKind::NixBuild, 0.9, reason)
            } else {
                Classification::not_compilation(
                    "interactive nix shell (no -c/--command; not intercepted)",
                )
            }
        }
        // run / repl / eval / search / profile / registry / store / copy /
        // path-info / why-depends / flake metadata|show|update / --version / ...
        // are execution, mutation, or metadata: never intercepted.
        _ => Classification::not_compilation("nix subcommand is not an offloadable build"),
    }
}

/// Split a shell command string on unquoted `;`, `&&`, and `||` operators.
///
/// Returns a list of sub-commands with each segment trimmed of whitespace.
/// Characters inside single quotes, double quotes, or backticks are treated
/// as literal and are never split. Escaped quotes (`\'`, `\"`) do not toggle
/// quote state. Pipes (`|`) within a segment are preserved (they are part of
/// one command, not a command separator).
///
/// Performance: single-pass O(n) character state machine, no regex, no heap
/// allocation for the common single-command case.
pub fn split_shell_commands(cmd: &str) -> Vec<&str> {
    let bytes = cmd.as_bytes();
    let len = bytes.len();
    let mut segments: Vec<&str> = Vec::new();
    let mut start = 0;
    let mut i = 0;

    // Quote state
    let mut in_single = false;
    let mut in_double = false;
    let mut in_backtick = false;
    let mut escaped = false;

    while i < len {
        let b = bytes[i];

        if escaped {
            escaped = false;
            i += 1;
            continue;
        }

        // POSIX: backslash is LITERAL inside single quotes; only honor it as an
        // escape when not in a single-quoted span, or the next `'` is wrongly
        // swallowed and the quote stays "open", hiding an exposed operator
        // (bd-review-singlequote-escape).
        if b == b'\\' && !in_single {
            escaped = true;
            i += 1;
            continue;
        }

        // Toggle quote state
        if !in_double && !in_backtick && b == b'\'' {
            in_single = !in_single;
            i += 1;
            continue;
        }
        if !in_single && !in_backtick && b == b'"' {
            in_double = !in_double;
            i += 1;
            continue;
        }
        if !in_single && !in_double && b == b'`' {
            in_backtick = !in_backtick;
            i += 1;
            continue;
        }

        // Only split when outside all quotes
        if in_single || in_double || in_backtick {
            i += 1;
            continue;
        }

        // Check for `&&`
        if b == b'&' && i + 1 < len && bytes[i + 1] == b'&' {
            let seg = cmd[start..i].trim();
            if !seg.is_empty() {
                segments.push(seg);
            }
            i += 2;
            start = i;
            continue;
        }

        // Check for `||`
        if b == b'|' && i + 1 < len && bytes[i + 1] == b'|' {
            let seg = cmd[start..i].trim();
            if !seg.is_empty() {
                segments.push(seg);
            }
            i += 2;
            start = i;
            continue;
        }

        // Check for `;`
        if b == b';' {
            let seg = cmd[start..i].trim();
            if !seg.is_empty() {
                segments.push(seg);
            }
            i += 1;
            start = i;
            continue;
        }

        i += 1;
    }

    // Push the final segment
    let seg = cmd[start..].trim();
    if !seg.is_empty() {
        segments.push(seg);
    }

    segments
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn cargo_xwin_builds_use_the_cargo_build_contract() {
        for command in [
            "cargo xwin build --release --locked --target x86_64-pc-windows-msvc",
            "cargo +nightly-2026-08-31 xwin build --target=aarch64-pc-windows-msvc",
            "cargo --color never --locked xwin build",
            "env CARGO_HOME=/root/.cargo cargo xwin build --release",
            "cargo-xwin build --release",
            "cargo-xwin xwin build --release",
            "/home/ubuntu/.local/bin/cargo-xwin xwin build --release",
        ] {
            assert!(is_cargo_xwin_build(command), "{command}");
            let classification = classify_command(command);
            assert!(classification.is_compilation, "{command}");
            assert_eq!(
                classification.kind,
                Some(CompilationKind::CargoBuild),
                "{command}"
            );
        }
    }

    #[test]
    fn cargo_xwin_recognition_declines_non_builds_and_argument_mentions() {
        for command in [
            "cargo xwin",
            "cargo xwin env",
            "cargo xwin cache clear",
            "cargo xwin check",
            "cargo xwin publish",
            "cargo xwin build --help",
            "cargo-xwin --version",
            "cargo-xwin cache clear",
            "cargo-xwin xwin build --help",
            "cargo --config xwin build --target x86_64-pc-windows-msvc",
            "cargo build --manifest-path cargo-xwin --target x86_64-pc-windows-msvc",
            "echo cargo xwin build",
            "cargo xwin build && cargo build",
        ] {
            assert!(!is_cargo_xwin_build(command), "{command}");
        }
        for command in [
            "cargo xwin env",
            "cargo xwin cache clear",
            "cargo-xwin --version",
        ] {
            assert!(!classify_command(command).is_compilation, "{command}");
        }
    }
    use crate::test_guard;

    #[test]
    fn test_cargo_build_with_toolchain() {
        let _guard = test_guard!();
        let result = classify_command("cargo +nightly build");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
    }

    // ===================== Nix classification (issue #26) =====================

    #[test]
    fn test_nix_build_offloadable() {
        let _guard = test_guard!();
        for cmd in [
            "nix build",
            "nix build .#foo",
            "nix build .#packages.x86_64-linux.default",
            "nix build /path/to/flake#pkg",
            "nix build --extra-experimental-features 'nix-command flakes' .#foo",
            "nix --option sandbox true build .#foo",
            "nix -j4 build .#foo",
            "nix build nixpkgs#hello -o result-hello",
        ] {
            let result = classify_command(cmd);
            assert!(result.is_compilation, "expected offload for `{cmd}`");
            assert_eq!(result.kind, Some(CompilationKind::NixBuild), "`{cmd}`");
            assert!(result.confidence >= 0.85, "`{cmd}` confidence too low");
        }
    }

    #[test]
    fn test_nix_build_legacy_offloadable() {
        let _guard = test_guard!();
        for cmd in ["nix-build", "nix-build .", "nix-build -A hello"] {
            let result = classify_command(cmd);
            assert!(result.is_compilation, "expected offload for `{cmd}`");
            assert_eq!(result.kind, Some(CompilationKind::NixBuild), "`{cmd}`");
        }
    }

    #[test]
    fn test_nix_flake_check_offloadable_but_metadata_not() {
        let _guard = test_guard!();
        let check = classify_command("nix flake check");
        assert!(check.is_compilation, "nix flake check should offload");
        assert_eq!(check.kind, Some(CompilationKind::NixBuild));

        for cmd in [
            "nix flake metadata",
            "nix flake show",
            "nix flake update",
            "nix flake lock",
            "nix flake info",
        ] {
            let result = classify_command(cmd);
            assert!(!result.is_compilation, "`{cmd}` must NOT offload");
        }
    }

    #[test]
    fn test_nix_develop_and_shell_only_with_command() {
        let _guard = test_guard!();
        // Non-interactive `-c`/`--command` forms are offloadable.
        for cmd in [
            "nix develop -c make",
            "nix develop --command cargo build",
            "nix develop .#dev -c bun test",
            "nix shell nixpkgs#gcc -c make",
            "nix shell nixpkgs#hello --command hello",
        ] {
            let result = classify_command(cmd);
            assert!(result.is_compilation, "expected offload for `{cmd}`");
            assert_eq!(result.kind, Some(CompilationKind::NixBuild), "`{cmd}`");
        }
        // Bare interactive shells must NOT be intercepted.
        for cmd in ["nix develop", "nix develop .#dev", "nix shell nixpkgs#gcc"] {
            let result = classify_command(cmd);
            assert!(
                !result.is_compilation,
                "`{cmd}` is interactive; must run local"
            );
        }
    }

    #[test]
    fn test_nix_execution_and_mutation_not_offloaded() {
        let _guard = test_guard!();
        for cmd in [
            "nix run .#app",
            "nix run nixpkgs#hello",
            "nix repl",
            "nix eval .#foo",
            "nix search nixpkgs hello",
            "nix profile install nixpkgs#hello",
            "nix registry list",
            "nix store gc",
            "nix copy --to ssh://host .#foo",
            "nix path-info .#foo",
            "nix --version",
            "nix build --help",
            "nix",
        ] {
            let result = classify_command(cmd);
            assert!(!result.is_compilation, "`{cmd}` must NOT be intercepted");
        }
    }

    #[test]
    fn test_nix_legacy_mutating_tools_have_no_keyword() {
        let _guard = test_guard!();
        // `nix-env`, `nix-shell`, `nix-store`, ... only share the "nix-" prefix;
        // they are NOT the `nix`/`nix-build` keywords, so Tier-2 rejects them
        // before classification (no accidental interception).
        for cmd in [
            "nix-env -iA nixpkgs.hello",
            "nix-shell",
            "nix-shell -p gcc",
            "nix-store --gc",
            "nix-collect-garbage -d",
            "nix-channel --update",
        ] {
            assert!(
                !starts_with_compilation_command(cmd),
                "`{cmd}` should not match any compilation keyword"
            );
            let result = classify_command(cmd);
            assert!(!result.is_compilation, "`{cmd}` must NOT be intercepted");
        }
    }

    #[test]
    fn test_nix_build_maps_to_nix_runtime_base() {
        let _guard = test_guard!();
        assert_eq!(CompilationKind::NixBuild.command_base(), "nix");
        assert!(!CompilationKind::NixBuild.is_test_command());
    }

    #[test]
    fn test_nix_build_compound_and_wrapped() {
        let _guard = test_guard!();
        // Compound `cd X && nix build` should offload the nix build tail.
        let compound = classify_command("cd /repo && nix build .#foo");
        assert!(compound.is_compilation, "compound nix build should offload");
        assert_eq!(compound.kind, Some(CompilationKind::NixBuild));
        // `bash -c "nix build .#foo"` wrapper should offload the inner command.
        let wrapped = classify_command("bash -c \"nix build .#foo\"");
        assert!(wrapped.is_compilation, "wrapped nix build should offload");
        assert_eq!(wrapped.kind, Some(CompilationKind::NixBuild));
    }

    #[test]
    fn test_job_kind_serde_and_base_token() {
        let _guard = test_guard!();
        // The wire name is stable snake_case so rchd/telemetry can record it.
        let json = serde_json::to_string(&CompilationKind::Job).unwrap();
        assert_eq!(json, "\"job\"");
        let round: CompilationKind = serde_json::from_str(&json).unwrap();
        assert_eq!(round, CompilationKind::Job);
        // Total mapping token (see command_base docs — the hook-path allowlist
        // gate can never observe this kind).
        assert_eq!(CompilationKind::Job.command_base(), "job");
        assert!(!CompilationKind::Job.is_test_command());
    }

    #[test]
    fn test_cargo_test_with_toolchain() {
        let _guard = test_guard!();
        let result = classify_command("cargo +1.80.0 test");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_nextest_with_toolchain() {
        let _guard = test_guard!();
        let result = classify_command("cargo +nightly nextest run");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
    }

    #[test]
    fn test_cargo_build() {
        let _guard = test_guard!();
        let result = classify_command("cargo build");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert!(result.confidence >= 0.90);
    }

    #[test]
    fn test_cargo_build_release() {
        let _guard = test_guard!();
        let result = classify_command("cargo build --release");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
    }

    #[test]
    fn test_cargo_test() {
        let _guard = test_guard!();
        let result = classify_command("cargo test");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_fmt_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("cargo fmt");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_cargo_install_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("cargo install ripgrep");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_piped_to_benign_pager_intercepted() {
        let _guard = test_guard!();
        // Issue #24: piping a compilation command's output into a benign pager
        // (grep/head/tee/...) is now offloaded, with the pipe re-attached to the
        // offloaded command's output.
        let result = classify_command("cargo build 2>&1 | grep error");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo build 2>&1 | grep error")
        );
    }

    #[test]
    fn test_piped_to_nonbenign_command_not_intercepted() {
        let _guard = test_guard!();
        // Piping into a non-pager command stays conservative (declined).
        let result = classify_command("cargo build | xargs rm");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("piped"));
    }

    #[test]
    fn test_backgrounded_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a trailing `&` (backgrounding) is now offloaded.
        let result = classify_command("cargo build &");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert_eq!(result.extracted_command.as_deref(), Some("cargo build &"));
    }

    #[test]
    fn test_newline_injection_not_intercepted() {
        let _guard = test_guard!();
        // Newlines could cause command injection via `sh -c`
        let result = classify_command("cargo build\nrm -rf /");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("newline"));

        let result = classify_command("cargo build\r\nrm -rf /");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("newline"));

        for command in [
            "cargo build > out.log\nrm -rf /",
            "cargo build | tee out.log\r\nrm -rf /",
            "cargo build &\nrm -rf /",
        ] {
            let result = classify_command(command);
            assert!(
                !result.is_compilation,
                "newline-bearing benign suffix must fail closed: {command:?}"
            );
            assert!(result.reason.contains("newline"), "{result:?}");
        }
    }

    #[test]
    fn test_redirected_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a benign stdout/stderr file redirect is now offloaded with
        // the redirect re-attached to the offloaded command's output.
        let result = classify_command("cargo build > log.txt");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo build > log.txt")
        );

        let result = classify_command("cargo test --workspace > out.log 2>&1");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo test --workspace > out.log 2>&1")
        );

        // File-descriptor redirects must remain byte-for-byte adjacent. A
        // space before `>` turns the descriptor into a command argument.
        for command in [
            "cargo build 2>errors.txt",
            "cargo build 2>>errors.txt",
            "cargo build >out.log 2>&1",
        ] {
            let result = classify_command(command);
            assert!(result.is_compilation, "got: {:?}", result.reason);
            assert_eq!(result.extracted_command.as_deref(), Some(command));
        }
    }

    #[test]
    fn test_input_redirected_not_intercepted() {
        let _guard = test_guard!();
        // Input redirects transform the command's INPUT and are never offloaded.
        let result = classify_command("cargo build < input.txt");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("input redirected"));
    }

    #[test]
    fn test_process_substitution_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("cargo build --config <(echo ...)");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("subshell execution"));
    }

    #[test]
    fn test_subshell_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("(cargo build)");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("subshell execution"));
    }

    #[test]
    fn test_make_maintenance_matches_whole_target_tokens() {
        // Regression (bd-review-make-ninja-substring): maintenance targets must
        // match as whole TARGET tokens, not as a substring anywhere.
        let _guard = test_guard!();

        // Real maintenance targets are still rejected.
        for cmd in [
            "make clean",
            "make install",
            "make distclean",
            "make uninstall",
        ] {
            let r = classify_command(cmd);
            assert!(!r.is_compilation, "{cmd} should not be intercepted");
            assert!(r.reason.contains("make maintenance command"), "{cmd}");
        }
        // With parallelism flags too.
        let r = classify_command("make -j8 clean");
        assert!(!r.is_compilation);

        // Real builds whose tokens merely CONTAIN a maintenance word are builds.
        for cmd in [
            "make CFLAGS=-Iinstall/include",
            "make build INSTALL_DIR=/x",
            "make TARGET=cleanup",
            "make clean-all",  // distinct target, not "clean"
            "make -C install", // build in a directory named "install"
        ] {
            let r = classify_command(cmd);
            assert!(r.is_compilation, "{cmd} should be intercepted as a build");
            assert_eq!(r.kind, Some(CompilationKind::Make), "{cmd}");
        }
    }

    #[test]
    fn test_ninja_clean_matches_tool_and_whole_target() {
        // Regression (bd-review-make-ninja-substring): only `-t clean` and a
        // whole-token `clean` target are maintenance.
        let _guard = test_guard!();

        for cmd in ["ninja clean", "ninja -t clean", "ninja -j8 clean"] {
            let r = classify_command(cmd);
            assert!(!r.is_compilation, "{cmd} should not be intercepted");
            assert!(r.reason.contains("ninja clean"), "{cmd}");
        }

        for cmd in [
            "ninja build/clean_obj.o", // path containing "clean"
            "ninja -C clean",          // build in a directory named "clean"
            "ninja -j4",
        ] {
            let r = classify_command(cmd);
            assert!(r.is_compilation, "{cmd} should be intercepted as a build");
            assert_eq!(r.kind, Some(CompilationKind::Ninja), "{cmd}");
        }
    }

    #[test]
    fn test_gcc_compile() {
        let _guard = test_guard!();
        let result = classify_command("gcc -c main.c -o main.o");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::Gcc));
    }

    #[test]
    fn test_make() {
        let _guard = test_guard!();
        let result = classify_command("make -j8");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::Make));
    }

    #[test]
    fn test_make_clean_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("make clean");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("make maintenance command"));
    }

    #[test]
    fn test_cmake_build_requires_cmake_command() {
        let _guard = test_guard!();
        let result = classify_command("echo cmake --build .");
        assert!(!result.is_compilation);
    }

    #[test]
    fn test_cmake_build_with_equals_flag() {
        let _guard = test_guard!();
        let result = classify_command("cmake --build=build");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CmakeBuild));
    }

    #[test]
    fn test_meson_compile_requires_meson_command() {
        let _guard = test_guard!();
        let result = classify_command("echo meson compile");
        assert!(!result.is_compilation);
    }

    #[test]
    fn test_non_compilation() {
        let _guard = test_guard!();
        let result = classify_command("ls -la");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("no compilation keyword"));
    }

    #[test]
    fn test_empty_command() {
        let _guard = test_guard!();
        let result = classify_command("");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("empty command"));
    }

    // Bun tests - keyword detection and never-intercept patterns

    #[test]
    fn test_bun_keyword_detected() {
        let _guard = test_guard!();
        // Verify "bun" command words trigger Tier 2 before Tier 3 decides
        // whether the subcommand is safe to intercept.
        assert!(starts_with_compilation_command("bun test"));
        assert!(starts_with_compilation_command("bun typecheck"));
        assert!(starts_with_compilation_command("bun install"));
    }

    #[test]
    fn test_bun_install_not_intercepted() {
        let _guard = test_guard!();
        // Package management - modifies node_modules
        let result = classify_command("bun install");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_add_not_intercepted() {
        let _guard = test_guard!();
        // Adding packages - modifies package.json and node_modules
        let result = classify_command("bun add lodash");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_remove_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun remove lodash");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_run_not_intercepted() {
        let _guard = test_guard!();
        // Generic script runner - could do anything
        let result = classify_command("bun run build");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_build_not_intercepted() {
        let _guard = test_guard!();
        // Creates bundles in local directory
        let result = classify_command("bun build ./src/index.ts");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_version_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun --version");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));

        let result = classify_command("bun -v");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_dev_not_intercepted() {
        let _guard = test_guard!();
        // Development server needs local ports
        let result = classify_command("bun dev");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_repl_not_intercepted() {
        let _guard = test_guard!();
        // Interactive REPL
        let result = classify_command("bun repl");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_link_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun link");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_init_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun init");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_create_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun create next-app");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_pm_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun pm cache");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bun_help_not_intercepted() {
        let _guard = test_guard!();
        let result = classify_command("bun --help");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));

        let result = classify_command("bun -h");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    // Bun Tier 4 classification tests

    #[test]
    fn test_bun_test_classification() {
        let _guard = test_guard!();
        // Basic command
        let result = classify_command("bun test");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));
        assert!((result.confidence - 0.95).abs() < 0.001);

        // With directory argument
        let result = classify_command("bun test src/");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // With coverage flag (non-interactive)
        let result = classify_command("bun test --coverage");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // Specific file
        let result = classify_command("bun test auth.test.ts");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // With multiple flags
        let result = classify_command("bun test --bail --timeout 5000");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // With reporter
        let result = classify_command("bun test --reporter json");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));
    }

    #[test]
    fn test_bun_test_watch_not_intercepted() {
        let _guard = test_guard!();
        // --watch mode is interactive and should NOT be intercepted
        let result = classify_command("bun test --watch");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("interactive"));

        // Watch with other flags
        let result = classify_command("bun test --watch --coverage");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("interactive"));

        // Watch with directory
        let result = classify_command("bun test src/ --watch");
        assert!(!result.is_compilation);

        // Short form -w
        let result = classify_command("bun test -w");
        assert!(!result.is_compilation);

        // Short form with args
        let result = classify_command("bun test -w src/");
        assert!(!result.is_compilation);
    }

    #[test]
    fn test_bun_typecheck_watch_not_intercepted() {
        let _guard = test_guard!();
        // --watch mode is interactive and should NOT be intercepted
        let result = classify_command("bun typecheck --watch");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("interactive"));

        // Short form -w
        let result = classify_command("bun typecheck -w");
        assert!(!result.is_compilation);
    }

    #[test]
    fn test_bun_typecheck_classification() {
        let _guard = test_guard!();
        // Basic command
        let result = classify_command("bun typecheck");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTypecheck));
        assert!((result.confidence - 0.95).abs() < 0.001);

        // With directory argument
        let result = classify_command("bun typecheck src/");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::BunTypecheck));

        // NOTE: --watch mode is tested separately in test_bun_typecheck_watch_not_intercepted
        // It should NOT be intercepted as it's interactive
    }

    #[test]
    fn test_bun_edge_cases_not_matched() {
        let _guard = test_guard!();
        // Invalid commands should not match
        let result = classify_command("bun testing");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("no matching pattern"));

        let result = classify_command("bun typechecker");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("no matching pattern"));

        let result = classify_command("bun type");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("no matching pattern"));

        // bun x should not be intercepted (runs arbitrary packages like npx)
        let result = classify_command("bun x eslint");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("bun x runs arbitrary packages"));

        let result = classify_command("bun x prettier --write .");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("bun x runs arbitrary packages"));

        let result = classify_command("bun x vitest run");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("bun x runs arbitrary packages"));
    }

    #[test]
    fn test_bun_test_vs_never_intercept() {
        let _guard = test_guard!();
        // bun test should NOT be blocked by never-intercept
        let result = classify_command("bun test");
        assert!(!result.reason.contains("never-intercept"));
        assert!(result.is_compilation);
    }

    #[test]
    fn test_bun_typecheck_vs_never_intercept() {
        let _guard = test_guard!();
        // bun typecheck should NOT be blocked by never-intercept
        let result = classify_command("bun typecheck");
        assert!(!result.reason.contains("never-intercept"));
        assert!(result.is_compilation);
    }

    // Bun CompilationKind serialization tests

    #[test]
    fn test_bun_compilation_kind_serde() {
        let _guard = test_guard!();
        // BunTest serialization
        let kind = CompilationKind::BunTest;
        let json = serde_json::to_string(&kind).unwrap();
        assert_eq!(json, "\"bun_test\"");
        let parsed: CompilationKind = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed, CompilationKind::BunTest);

        // BunTypecheck serialization
        let kind = CompilationKind::BunTypecheck;
        let json = serde_json::to_string(&kind).unwrap();
        assert_eq!(json, "\"bun_typecheck\"");
        let parsed: CompilationKind = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed, CompilationKind::BunTypecheck);
    }

    #[test]
    fn test_bun_kinds_are_distinct() {
        let _guard = test_guard!();
        // BunTest and BunTypecheck are different
        assert_ne!(CompilationKind::BunTest, CompilationKind::BunTypecheck);
        // BunTest is different from CargoTest (different ecosystems)
        assert_ne!(CompilationKind::BunTest, CompilationKind::CargoTest);
    }

    #[test]
    fn test_wrapped_command_classification_repro() {
        let _guard = test_guard!();
        // This fails currently because classify_full expects command to start with "cargo"
        // Wrapper tools like "time", "sudo", "env" break this logic
        let result = classify_command("time cargo build");
        assert!(
            result.is_compilation,
            "Should classify 'time cargo build' as compilation"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));

        let result = classify_command("sudo cargo check");
        assert!(
            result.is_compilation,
            "Should classify 'sudo cargo check' as compilation"
        );

        let result = classify_command("env RUST_BACKTRACE=1 cargo test");
        assert!(
            result.is_compilation,
            "Should classify env-wrapped cargo test as compilation"
        );

        let result = classify_command("env 'CARGO_TARGET_DIR=/data/tmp/rch-target' cargo build");
        assert!(
            result.is_compilation,
            "Should classify shell-quoted env assignment before cargo build as compilation"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
    }

    // =========================================================================
    // Bun E2E Edge Case Tests (from bead remote_compilation_helper-65m)
    // =========================================================================

    #[test]
    fn test_bun_piped_to_benign_pager_intercepted() {
        let _guard = test_guard!();
        // Issue #24: piping a bun test/typecheck into a benign pager is offloaded.
        let result = classify_command("bun test | grep error");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::BunTest));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("bun test | grep error")
        );

        // Piped with output filtering
        let result = classify_command("bun test 2>&1 | tee output.log");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("bun test 2>&1 | tee output.log")
        );

        // Piped typecheck
        let result = classify_command("bun typecheck | head -20");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::BunTypecheck));
    }

    #[test]
    fn test_bunx_tsc_not_intercepted() {
        let _guard = test_guard!();
        // bunx (bun x) runs arbitrary packages - should NOT be intercepted
        // even for typecheck-like commands like tsc
        let result = classify_command("bun x tsc --noEmit");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("bun x"));

        // bunx with other tools
        let result = classify_command("bun x eslint .");
        assert!(!result.is_compilation);

        let result = classify_command("bun x prettier --write .");
        assert!(!result.is_compilation);

        let result = classify_command("bun x vitest run");
        assert!(!result.is_compilation);
    }

    #[test]
    fn test_bun_redirected_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a benign output redirect is offloaded.
        let result = classify_command("bun test > results.txt");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("bun test > results.txt")
        );

        let result = classify_command("bun typecheck > errors.log");
        assert!(result.is_compilation, "got: {:?}", result.reason);
    }

    #[test]
    fn test_bun_backgrounded_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a trailing `&` is offloaded.
        let result = classify_command("bun test &");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.extracted_command.as_deref(), Some("bun test &"));
    }

    #[test]
    fn test_bun_chained_commands_classified() {
        let _guard = test_guard!();
        // Multi-command strings should be rejected
        let result = classify_command("bun test && echo done");
        assert!(
            !result.is_compilation,
            "chained commands should be rejected"
        );
        assert!(result.reason.contains("chained"));

        let result = classify_command("bun typecheck; bun test");
        assert!(
            !result.is_compilation,
            "chained commands should be rejected"
        );
        assert!(result.reason.contains("chained"));
    }

    #[test]
    fn test_bun_subshell_capture_not_intercepted() {
        let _guard = test_guard!();
        // Subshell capture should be rejected at Tier 1
        let result = classify_command("bun test $(echo src/)");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("subshell"));
    }

    #[test]
    fn test_bun_wrapped_commands() {
        let _guard = test_guard!();
        // Wrapped bun commands should still be classified
        // (requires normalize_command to handle wrappers)
        let result = classify_command("time bun test");
        // Currently may or may not work depending on normalize_command
        // This test documents current behavior
        if result.is_compilation {
            assert_eq!(result.kind, Some(CompilationKind::BunTest));
        }

        let result = classify_command("env DEBUG=1 bun test");
        if result.is_compilation {
            assert_eq!(result.kind, Some(CompilationKind::BunTest));
        }
    }

    #[test]
    fn test_classify_command_detailed_matches_basic() {
        let _guard = test_guard!();
        let commands = [
            "cargo build",
            "cargo test --release",
            "bun typecheck",
            "gcc -c main.c -o main.o",
            "cd /tmp && cargo build --release",
            "ls -la",
        ];

        for cmd in commands {
            let basic = classify_command(cmd);
            let detailed = classify_command_detailed(cmd);
            assert_eq!(basic, detailed.classification);
        }
    }

    #[test]
    fn test_classify_command_detailed_rejects_piped() {
        let _guard = test_guard!();
        // Pipe into a NON-benign command is still rejected at Tier 1. (A pipe
        // into a benign pager like `tee` is now offloaded per issue #24.)
        let detailed = classify_command_detailed("cargo build | xargs rm");
        assert!(!detailed.classification.is_compilation);
        let tier1 = detailed.tiers.iter().find(|t| t.tier.eq(&1)).unwrap();
        assert_eq!(tier1.decision, TierDecision::Reject);
        assert!(tier1.reason.contains("piped"));

        // A pipe into a benign pager passes Tier 1 and is offloaded.
        let detailed = classify_command_detailed("cargo build | tee log.txt");
        assert!(detailed.classification.is_compilation);
        assert_eq!(
            detailed.classification.extracted_command.as_deref(),
            Some("cargo build | tee log.txt")
        );
    }

    #[test]
    fn test_classify_command_detailed_normalizes_wrappers() {
        let _guard = test_guard!();
        for (cmd, normalized) in [
            ("sudo cargo check", "cargo check"),
            ("env -u RUST_LOG cargo test", "cargo test"),
        ] {
            let detailed = classify_command_detailed(cmd);
            assert_eq!(
                (
                    detailed.normalized.as_str(),
                    detailed.classification.is_compilation
                ),
                (normalized, true),
                "{cmd}"
            );
        }
    }

    #[test]
    fn test_classify_command_detailed_matches_compound_command() {
        let _guard = test_guard!();
        let detailed = classify_command_detailed("cd /tmp && cargo build --release");

        assert!(detailed.classification.is_compilation);
        assert_eq!(
            detailed.classification.kind,
            Some(CompilationKind::CargoBuild)
        );
        assert_eq!(
            detailed.classification.command_prefix.as_deref(),
            Some("cd /tmp && ")
        );
        assert_eq!(
            detailed.classification.extracted_command.as_deref(),
            Some("cargo build --release")
        );
        assert_eq!(detailed.normalized, "cargo build --release");
        assert_eq!(detailed.tiers.len(), 5);
        assert!(
            detailed
                .tiers
                .iter()
                .all(|tier| tier.decision == TierDecision::Pass)
        );
    }

    // =========================================================================
    // Comprehensive cargo test variant tests (bead remote_compilation_helper-xcvl)
    // =========================================================================

    #[test]
    fn test_cargo_test_release() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --release");
        assert!(
            result.is_compilation,
            "cargo test --release should be classified as compilation"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
        assert!(result.confidence >= 0.90);
    }

    #[test]
    fn test_cargo_test_specific_test_name() {
        let _guard = test_guard!();
        let result = classify_command("cargo test my_test_function");
        assert!(
            result.is_compilation,
            "cargo test with specific test name should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_with_nocapture() {
        let _guard = test_guard!();
        let result = classify_command("cargo test -- --nocapture");
        assert!(
            result.is_compilation,
            "cargo test -- --nocapture should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_workspace() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --workspace");
        assert!(
            result.is_compilation,
            "cargo test --workspace should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_package() {
        let _guard = test_guard!();
        let result = classify_command("cargo test -p rch-common");
        assert!(result.is_compilation, "cargo test -p should be classified");
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_short_alias() {
        let _guard = test_guard!();
        // cargo t is an alias for cargo test
        let result = classify_command("cargo t");
        assert!(
            result.is_compilation,
            "cargo t (short alias) should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_all_features() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --all-features");
        assert!(
            result.is_compilation,
            "cargo test --all-features should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_no_default_features() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --no-default-features");
        assert!(
            result.is_compilation,
            "cargo test --no-default-features should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_with_env_var() {
        let _guard = test_guard!();
        let result = classify_command("RUST_BACKTRACE=1 cargo test");
        assert!(
            result.is_compilation,
            "cargo test with env var should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_with_multiple_flags() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --release --workspace -p rch -- --nocapture");
        assert!(
            result.is_compilation,
            "cargo test with multiple flags should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_with_jobs() {
        let _guard = test_guard!();
        let result = classify_command("cargo test -j 8");
        assert!(result.is_compilation, "cargo test -j should be classified");
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_target() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --target x86_64-unknown-linux-gnu");
        assert!(
            result.is_compilation,
            "cargo test --target should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_lib() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --lib");
        assert!(
            result.is_compilation,
            "cargo test --lib should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_bins() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --bins");
        assert!(
            result.is_compilation,
            "cargo test --bins should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_doc() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --doc");
        assert!(
            result.is_compilation,
            "cargo test --doc should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_filter_pattern() {
        let _guard = test_guard!();
        let result = classify_command("cargo test test_classification");
        assert!(
            result.is_compilation,
            "cargo test with filter pattern should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_test_exact() {
        let _guard = test_guard!();
        let result = classify_command("cargo test --exact my_test");
        assert!(
            result.is_compilation,
            "cargo test --exact should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
    }

    // =========================================================================
    // cargo-nextest tests (bead remote_compilation_helper-c7ky)
    // =========================================================================

    #[test]
    fn test_nextest_keyword_detected() {
        let _guard = test_guard!();
        // Verify nextest command words trigger Tier 2 before subcommand checks.
        assert!(starts_with_compilation_command("cargo nextest run"));
        assert!(starts_with_compilation_command("cargo nextest list"));
    }

    #[test]
    fn test_cargo_nextest_run_classification() {
        let _guard = test_guard!();
        // Basic command
        let result = classify_command("cargo nextest run");
        assert!(
            result.is_compilation,
            "cargo nextest run should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
        assert!((result.confidence - 0.95).abs() < 0.001);
    }

    #[test]
    fn test_cargo_nextest_run_with_flags() {
        let _guard = test_guard!();
        // With release flag
        let result = classify_command("cargo nextest run --release");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        // With profile flag
        let result = classify_command("cargo nextest run --cargo-profile ci");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        // With workspace flag
        let result = classify_command("cargo nextest run --workspace");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        // With package filter
        let result = classify_command("cargo nextest run -p rch-common");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        // With test filter
        let result = classify_command("cargo nextest run test_classification");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        // With multiple flags
        let result = classify_command("cargo nextest run --release --no-fail-fast -j 8");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
    }

    #[test]
    fn test_cargo_nextest_run_short_alias() {
        let _guard = test_guard!();
        // cargo nextest r is an alias for cargo nextest run
        let result = classify_command("cargo nextest r");
        assert!(
            result.is_compilation,
            "cargo nextest r should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
    }

    #[test]
    fn test_cargo_nextest_list_not_intercepted() {
        let _guard = test_guard!();
        // cargo nextest list only shows tests, doesn't run them
        let result = classify_command("cargo nextest list");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_cargo_nextest_archive_not_intercepted() {
        let _guard = test_guard!();
        // cargo nextest archive creates archives
        let result = classify_command("cargo nextest archive");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_cargo_nextest_show_not_intercepted() {
        let _guard = test_guard!();
        // cargo nextest show displays config info
        let result = classify_command("cargo nextest show");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("never-intercept"));
    }

    #[test]
    fn test_bare_cargo_nextest_not_intercepted() {
        let _guard = test_guard!();
        // bare "cargo nextest" without subcommand
        let result = classify_command("cargo nextest");
        assert!(!result.is_compilation);
        assert!(result.reason.contains("without subcommand"));
    }

    #[test]
    fn test_cargo_nextest_wrapped_commands() {
        let _guard = test_guard!();
        // Wrapped nextest commands should still be classified
        let result = classify_command("time cargo nextest run");
        assert!(
            result.is_compilation,
            "time cargo nextest run should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));

        let result = classify_command("RUST_BACKTRACE=1 cargo nextest run");
        assert!(
            result.is_compilation,
            "env-wrapped cargo nextest run should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
    }

    #[test]
    fn test_cargo_nextest_compilation_kind_serde() {
        let _guard = test_guard!();
        // CargoNextest serialization
        let kind = CompilationKind::CargoNextest;
        let json = serde_json::to_string(&kind).unwrap();
        assert_eq!(json, "\"cargo_nextest\"");
        let parsed: CompilationKind = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed, CompilationKind::CargoNextest);
    }

    #[test]
    fn test_cargo_nextest_vs_cargo_test_distinct() {
        let _guard = test_guard!();
        // CargoNextest and CargoTest are different
        assert_ne!(CompilationKind::CargoNextest, CompilationKind::CargoTest);

        // Both should be classified but as different kinds
        let nextest_result = classify_command("cargo nextest run");
        let test_result = classify_command("cargo test");
        assert!(nextest_result.is_compilation);
        assert!(test_result.is_compilation);
        assert_eq!(nextest_result.kind, Some(CompilationKind::CargoNextest));
        assert_eq!(test_result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_nextest_piped_to_pager_intercepted() {
        let _guard = test_guard!();
        // Issue #24: piping into a benign pager is offloaded.
        let result = classify_command("cargo nextest run | grep FAIL");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoNextest));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo nextest run | grep FAIL")
        );
    }

    #[test]
    fn test_cargo_nextest_redirected_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a benign output redirect is offloaded.
        let result = classify_command("cargo nextest run > results.txt");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo nextest run > results.txt")
        );
    }

    #[test]
    fn test_cargo_nextest_backgrounded_intercepted() {
        let _guard = test_guard!();
        // Issue #24: a trailing `&` is offloaded.
        let result = classify_command("cargo nextest run &");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo nextest run &")
        );
    }

    // =========================================================================
    // cargo bench tests (bead remote_compilation_helper-8o52)
    // =========================================================================

    #[test]
    fn test_cargo_bench_classification() {
        let _guard = test_guard!();
        let result = classify_command("cargo bench");
        assert!(result.is_compilation, "cargo bench should be classified");
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));
        assert!((result.confidence - 0.90).abs() < 0.001);
    }

    #[test]
    fn test_cargo_bench_with_filter() {
        let _guard = test_guard!();
        // Benchmarks with name filter
        let result = classify_command("cargo bench my_bench");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));
    }

    #[test]
    fn test_cargo_bench_with_flags() {
        let _guard = test_guard!();
        // With release flag (benchmarks typically use release)
        let result = classify_command("cargo bench --release");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));

        // With package flag
        let result = classify_command("cargo bench -p rch-common");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));

        // With features
        let result = classify_command("cargo bench --features benchmarks");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));

        // With target filter
        let result = classify_command("cargo bench --bench criterion_bench");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));
    }

    #[test]
    fn test_cargo_bench_wrapped() {
        let _guard = test_guard!();
        // Wrapped with time
        let result = classify_command("time cargo bench");
        assert!(
            result.is_compilation,
            "time cargo bench should be classified"
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));

        // With env var
        let result = classify_command("CARGO_INCREMENTAL=0 cargo bench");
        assert!(result.is_compilation);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));
    }

    #[test]
    fn test_cargo_bench_serde() {
        let _guard = test_guard!();
        // CargoBench serialization
        let kind = CompilationKind::CargoBench;
        let json = serde_json::to_string(&kind).unwrap();
        assert_eq!(json, "\"cargo_bench\"");
        let parsed: CompilationKind = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed, CompilationKind::CargoBench);
    }

    #[test]
    fn test_cargo_bench_distinct_from_test() {
        let _guard = test_guard!();
        // CargoBench and CargoTest are different
        assert_ne!(CompilationKind::CargoBench, CompilationKind::CargoTest);

        // Both should be classified but as different kinds
        let bench_result = classify_command("cargo bench");
        let test_result = classify_command("cargo test");
        assert!(bench_result.is_compilation);
        assert!(test_result.is_compilation);
        assert_eq!(bench_result.kind, Some(CompilationKind::CargoBench));
        assert_eq!(test_result.kind, Some(CompilationKind::CargoTest));
    }

    #[test]
    fn test_cargo_bench_piped_to_pager_intercepted() {
        let _guard = test_guard!();
        // Issue #24: piping into a benign pager (tee) is offloaded.
        let result = classify_command("cargo bench | tee output.txt");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoBench));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo bench | tee output.txt")
        );
    }

    #[test]

    fn test_normalize_path_and_wrapper_bug_repro() {
        let _guard = test_guard!();
        // Case: /usr/bin/time cargo build

        // Current behavior: strips path -> "time cargo build", then returns.

        // Desired behavior: strips path -> "time cargo build", then strips wrapper -> "cargo build".

        // This test asserts the CURRENT BROKEN behavior.

        let normalized = normalize_command("/usr/bin/time cargo build");

        assert_eq!(normalized, "cargo build");

        let result = classify_command("/usr/bin/time cargo build");

        assert!(result.is_compilation);
    }

    // ==========================================================================
    // Command Base Tests (bd-785w)
    // ==========================================================================

    #[test]
    fn test_command_base_rust() {
        let _guard = test_guard!();
        assert_eq!(CompilationKind::CargoBuild.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoTest.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoCheck.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoClippy.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoDoc.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoBench.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoNextest.command_base(), "cargo");
        assert_eq!(CompilationKind::Rustc.command_base(), "rustc");
    }

    #[test]
    fn test_command_base_c_cpp() {
        let _guard = test_guard!();
        assert_eq!(CompilationKind::Gcc.command_base(), "gcc");
        assert_eq!(CompilationKind::Gpp.command_base(), "g++");
        assert_eq!(CompilationKind::Clang.command_base(), "clang");
        assert_eq!(CompilationKind::Clangpp.command_base(), "clang++");
    }

    #[test]
    fn test_command_base_build_systems() {
        let _guard = test_guard!();
        assert_eq!(CompilationKind::Make.command_base(), "make");
        assert_eq!(CompilationKind::CmakeBuild.command_base(), "cmake");
        assert_eq!(CompilationKind::Ninja.command_base(), "ninja");
        assert_eq!(CompilationKind::Meson.command_base(), "meson");
    }

    #[test]
    fn test_command_base_bun() {
        let _guard = test_guard!();
        assert_eq!(CompilationKind::BunTest.command_base(), "bun");
        assert_eq!(CompilationKind::BunTypecheck.command_base(), "bun");
    }

    // ==========================================================================
    // Proptest: Command Classification with Random Inputs (bd-2kdm)
    // ==========================================================================

    mod proptest_classification {
        use super::*;
        use proptest::prelude::*;

        // Strategy for arbitrary strings (pure random)
        fn arbitrary_string() -> impl Strategy<Value = String> {
            prop::string::string_regex(".{0,500}").unwrap()
        }

        // Strategy for command-like strings with random suffixes
        fn command_like_string() -> impl Strategy<Value = String> {
            let prefixes = prop::sample::select(vec![
                "cargo", "rustc", "gcc", "g++", "clang", "make", "cmake", "ninja", "bun", "ls",
                "cd", "echo", "cat", "grep", "find", "rm", "mv", "cp", "mkdir",
            ]);
            (prefixes, "[ a-zA-Z0-9_.-]{0,200}")
                .prop_map(|(prefix, suffix)| format!("{}{}", prefix, suffix))
        }

        // Strategy for known compilation commands with random flags
        fn known_command_with_flags() -> impl Strategy<Value = String> {
            let base_commands = prop::sample::select(vec![
                "cargo build",
                "cargo test",
                "cargo check",
                "cargo clippy",
                "cargo run",
                "rustc",
                "gcc",
                "g++",
                "make",
                "bun test",
                "bun typecheck",
            ]);
            let flags = prop::collection::vec(
                prop::sample::select(vec![
                    "--release",
                    "--verbose",
                    "-j8",
                    "-p",
                    "--all",
                    "--workspace",
                    "--lib",
                    "--bin",
                    "-o",
                    "-c",
                ]),
                0..5,
            );
            (base_commands, flags).prop_map(|(cmd, flags)| {
                if flags.is_empty() {
                    cmd.to_string()
                } else {
                    format!("{} {}", cmd, flags.join(" "))
                }
            })
        }

        // Strategy for strings with unicode and control characters
        fn unicode_and_control_chars() -> impl Strategy<Value = String> {
            prop::string::string_regex(
                r"[\x00-\x1f\x80-\xff\u{100}-\u{10FFFF}a-zA-Z0-9 |>&;$()]{0,100}",
            )
            .unwrap()
        }

        // Strategy for shell-like commands with special characters
        fn shell_special_commands() -> impl Strategy<Value = String> {
            let components = prop::sample::select(vec![
                "cargo build",
                "ls -la",
                "echo test",
                "cat file.txt",
                "grep pattern",
            ]);
            let operators = prop::sample::select(vec![
                " | ", " && ", " || ", " ; ", " > ", " < ", " & ", " 2>&1 ", " $(", " `",
            ]);
            prop::collection::vec((components, operators), 1..4).prop_map(|pairs| {
                let mut result = String::new();
                for (i, (comp, op)) in pairs.iter().enumerate() {
                    if i > 0 {
                        result.push_str(op);
                    }
                    result.push_str(comp);
                }
                result
            })
        }

        // Strategy for wrapper-prefixed commands
        fn wrapped_commands() -> impl Strategy<Value = String> {
            let wrappers = prop::sample::select(vec![
                "sudo ",
                "env ",
                "time ",
                "nice ",
                "/usr/bin/time ",
                "RUST_BACKTRACE=1 ",
                "CC=clang ",
                "",
            ]);
            let commands = prop::sample::select(vec![
                "cargo build",
                "cargo test",
                "make",
                "gcc -c main.c",
                "ls -la",
            ]);
            (wrappers, commands).prop_map(|(wrapper, cmd)| format!("{}{}", wrapper, cmd))
        }

        proptest! {
            // Configure proptest for high-volume testing
            #![proptest_config(ProptestConfig::with_cases(1000))]

            // Test 1: Arbitrary strings never cause panics
            #[test]
            fn test_classify_arbitrary_no_panic(s in arbitrary_string()) {
                // Just call classify_command - if it panics, proptest will catch it
                let _ = classify_command(&s);
            }

            // Test 2: Command-like strings never cause panics
            #[test]
            fn test_classify_command_like_no_panic(s in command_like_string()) {
                let _ = classify_command(&s);
            }

            // Test 3: Known commands with flags produce valid classification
            #[test]
            fn test_classify_known_commands_valid(s in known_command_with_flags()) {
                let result = classify_command(&s);
                // Confidence should be in valid range
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0,
                    "Confidence {} out of range for command: {}", result.confidence, s);
                // If is_compilation, must have a kind
                if result.is_compilation {
                    prop_assert!(result.kind.is_some(),
                        "is_compilation=true but kind=None for: {}", s);
                }
            }

            // Test 4: Unicode and control characters never panic
            #[test]
            fn test_classify_unicode_no_panic(s in unicode_and_control_chars()) {
                let _ = classify_command(&s);
            }

            // Test 5: Shell special commands are handled
            #[test]
            fn test_classify_shell_special(s in shell_special_commands()) {
                let result = classify_command(&s);
                // Commands with shell operators should typically NOT be intercepted
                // (pipes, redirects, backgrounding, chaining)
                if s.contains(" | ") || s.contains(" > ") || s.contains(" < ") || s.contains(" & ") {
                    // May or may not be classified depending on quote handling
                    let _ = result; // Just ensure no panic
                }
            }

            // Test 6: Wrapped commands are handled
            #[test]
            fn test_classify_wrapped_commands(s in wrapped_commands()) {
                let result = classify_command(&s);
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0);
            }

            // Test 7: Classification is deterministic
            #[test]
            fn test_classify_deterministic(s in arbitrary_string()) {
                let result1 = classify_command(&s);
                let result2 = classify_command(&s);
                prop_assert_eq!(result1, result2,
                    "Non-deterministic classification for: {}", s);
            }

            // Test 8: Empty-ish strings handled correctly
            #[test]
            fn test_classify_whitespace_variants(s in "[ \t\n\r]{0,20}") {
        let _guard = test_guard!();
                let result = classify_command(&s);
                prop_assert!(!result.is_compilation,
                    "Whitespace-only command should not be classified as compilation: {:?}", s);
                prop_assert!(result.reason.contains("empty") || result.reason.contains("keyword"),
                    "Unexpected reason for whitespace: {}", result.reason);
            }

            // Test 9: Very long commands don't panic
            #[test]
            fn test_classify_long_commands(
                prefix in "cargo (build|test|check)",
                suffix in "[a-zA-Z0-9_ -]{0,10000}"
            ) {
                let long_cmd = format!("{} {}", prefix, suffix);
                let result = classify_command(&long_cmd);
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0);
            }

            // Test 10: Null bytes and special sequences
            #[test]
            fn test_classify_special_bytes(s in prop::collection::vec(any::<u8>(), 0..200)) {
                if let Ok(valid_str) = String::from_utf8(s.clone()) {
                    let _ = classify_command(&valid_str);
                }
                // Non-UTF8 sequences can't be tested with &str
            }
        }

        // Additional targeted proptest tests

        proptest! {
            #![proptest_config(ProptestConfig::with_cases(500))]

            // Test: Cargo subcommands with arbitrary suffixes
            #[test]
            fn test_cargo_subcommand_robustness(
                subcommand in "(build|test|check|clippy|fmt|clean|run|doc|bench|nextest)",
                suffix in "[a-zA-Z0-9_ -]{0,50}"
            ) {
                let cmd = format!("cargo {} {}", subcommand, suffix);
                let result = classify_command(&cmd);
                // Ensure valid result structure
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0);
                // fmt and clean should NEVER be classified as compilation
                if subcommand.eq("fmt") || subcommand.eq("clean") {
                    prop_assert!(!result.is_compilation,
                        "cargo {} should not be compilation: {}", subcommand, cmd);
                }
            }

            // Test: Bun commands robustness
            #[test]
            fn test_bun_command_robustness(
                subcommand in "(test|typecheck|install|add|remove|run|build|dev)",
                suffix in "[a-zA-Z0-9_ -]{0,30}"
            ) {
                let cmd = format!("bun {} {}", subcommand, suffix);
                let result = classify_command(&cmd);
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0);
                // install, add, remove, run, build, dev should NOT be compilation
                if matches!(subcommand.as_str(), "install" | "add" | "remove" | "run" | "build" | "dev") {
                    prop_assert!(!result.is_compilation,
                        "bun {} should not be compilation", subcommand);
                }
            }

            // Test: GCC/Clang commands with file patterns
            #[test]
            fn test_c_compiler_robustness(
                compiler in "(gcc|g\\+\\+|clang|clang\\+\\+)",
                flags in "(-[cCoOgW][a-z0-9]* )*",
                file in "[a-zA-Z_][a-zA-Z0-9_]*\\.(c|cpp|cc|h|hpp)"
            ) {
                let cmd = format!("{} {}{}", compiler, flags, file);
                let result = classify_command(&cmd);
                prop_assert!(result.confidence >= 0.0 && result.confidence <= 1.0);
            }

            // Test: Commands with quoted strings preserve correctness
            #[test]
            fn test_quoted_args_handling(
                base in "(cargo build|cargo test|gcc|make)",
                quoted_content in "[a-zA-Z0-9 _-]{0,30}"
            ) {
                // Single quotes
                let cmd_single = format!("{} '{}'", base, quoted_content);
                let _ = classify_command(&cmd_single);

                // Double quotes
                let cmd_double = format!("{} \"{}\"", base, quoted_content);
                let _ = classify_command(&cmd_double);
            }
        }

        // Regression test: ensure specific problematic inputs are handled
        #[test]
        fn test_known_edge_cases() {
            let _guard = test_guard!();
            // These are edge cases that might have caused issues
            let edge_cases = [
                "",
                " ",
                "\t",
                "\n",
                "cargo",
                "cargo ",
                "cargo  ",
                "cargo\tbuild",
                "cargo\nbuild",
                "cargo\rbuild",
                "cargo+nightly",
                "cargo +nightly",
                "cargo +nightly build",
                "  cargo build  ",
                "CARGO_TARGET_DIR=/tmp cargo build",
                "/usr/local/bin/cargo build",
                "~/.cargo/bin/cargo build",
                "./cargo build",
                "../cargo build",
                "cargo build 'test file.rs'",
                "cargo build \"test file.rs\"",
                "cargo build test\\ file.rs",
                "cargo build -- --test-threads=1",
                "cargo build --features \"feat1 feat2\"",
                "cargo build 2>&1",
                "cargo build 2>/dev/null",
                "gcc -DFOO=\"bar baz\" main.c",
                "make -j$(nproc)",
                "ninja -C build",
                "cmake --build . --target all",
                "bun test --timeout 5000 src/",
                "env -i PATH=/usr/bin cargo build",
            ];

            for cmd in edge_cases {
                let result = classify_command(cmd);
                assert!(
                    result.confidence >= 0.0 && result.confidence <= 1.0,
                    "Invalid confidence for: {:?}",
                    cmd
                );
            }
        }

        // Test that detailed classification matches simple classification
        #[test]
        fn test_detailed_matches_simple_proptest() {
            let _guard = test_guard!();
            let test_cases = [
                "cargo build --release",
                "cargo test",
                "make -j8",
                "ls -la",
                "echo hello",
            ];

            for cmd in test_cases {
                let simple = classify_command(cmd);
                let detailed = classify_command_detailed(cmd);
                assert_eq!(simple, detailed.classification, "Mismatch for: {}", cmd);
            }
        }

        // =================== split_shell_commands tests ===================

        #[test]
        fn test_split_single_command() {
            let _guard = test_guard!();
            assert_eq!(split_shell_commands("cargo build"), vec!["cargo build"]);
        }

        #[test]
        fn test_split_and_operator() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("cargo fmt && cargo build"),
                vec!["cargo fmt", "cargo build"]
            );
        }

        #[test]
        fn test_split_quoted_operator() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("echo '&&' && cargo build"),
                vec!["echo '&&'", "cargo build"]
            );
        }

        #[test]
        fn test_split_mixed_operators() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("cd /tmp && make -j4 || echo fail"),
                vec!["cd /tmp", "make -j4", "echo fail"]
            );
        }

        #[test]
        fn test_split_semicolons() {
            let _guard = test_guard!();
            assert_eq!(split_shell_commands("a ; b ; c"), vec!["a", "b", "c"]);
        }

        #[test]
        fn test_split_quoted_semicolon() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("echo 'hello;world' && make"),
                vec!["echo 'hello;world'", "make"]
            );
        }

        #[test]
        fn test_split_pipe_preserved() {
            let _guard = test_guard!();
            // Single pipe is NOT a command separator
            assert_eq!(
                split_shell_commands("cargo build 2>&1 | tee log"),
                vec!["cargo build 2>&1 | tee log"]
            );
        }

        #[test]
        fn test_split_double_quoted_operator() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands(r#"echo "&&" && cargo build"#),
                vec![r#"echo "&&""#, "cargo build"]
            );
        }

        #[test]
        fn test_split_nested_quotes() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("echo \"he said 'hello && bye'\" && cargo test"),
                vec!["echo \"he said 'hello && bye'\"", "cargo test"]
            );
        }

        #[test]
        fn test_split_escaped_quote() {
            let _guard = test_guard!();
            // Escaped quotes don't toggle state
            assert_eq!(
                split_shell_commands(r"echo it\'s && cargo build"),
                vec![r"echo it\'s", "cargo build"]
            );
        }

        #[test]
        fn test_split_backslash_literal_in_single_quotes() {
            let _guard = test_guard!();
            // POSIX: backslash is LITERAL inside single quotes, so 'a\' is the
            // string a\ and the closing quote ENDS the span — exposing the
            // following operator. Previously the \ swallowed the closing ',
            // kept the quote "open", and hid the && (bd-review-singlequote-escape).
            assert_eq!(
                split_shell_commands(r"cargo build 'a\' && rm -rf x"),
                vec![r"cargo build 'a\'", "rm -rf x"]
            );
        }

        #[test]
        fn test_split_empty_string() {
            let _guard = test_guard!();
            assert!(split_shell_commands("").is_empty());
        }

        #[test]
        fn test_split_only_whitespace() {
            let _guard = test_guard!();
            assert!(split_shell_commands("   ").is_empty());
        }

        #[test]
        fn test_split_backtick_quoting() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("echo `echo && fail` && cargo build"),
                vec!["echo `echo && fail`", "cargo build"]
            );
        }

        #[test]
        fn test_split_trailing_operator() {
            let _guard = test_guard!();
            // Trailing && with nothing after should yield just the first segment
            assert_eq!(split_shell_commands("cargo build &&"), vec!["cargo build"]);
        }

        // =================== fail-open safeguard tests (bd-16t3) ===================

        #[test]
        fn test_split_unclosed_single_quote() {
            let _guard = test_guard!();
            // Unclosed quote: everything stays "inside quotes", no split found
            let result = split_shell_commands("echo 'hello && cargo build");
            assert_eq!(result, vec!["echo 'hello && cargo build"]);
        }

        #[test]
        fn test_split_unclosed_double_quote() {
            let _guard = test_guard!();
            let result = split_shell_commands("echo \"hello && cargo build");
            assert_eq!(result, vec!["echo \"hello && cargo build"]);
        }

        #[test]
        fn test_split_unclosed_backtick() {
            let _guard = test_guard!();
            let result = split_shell_commands("echo `hello && cargo build");
            assert_eq!(result, vec!["echo `hello && cargo build"]);
        }

        #[test]
        fn test_split_embedded_nulls() {
            let _guard = test_guard!();
            // Embedded null bytes should not cause panic
            let input = "cargo build\0 && echo done";
            let result = split_shell_commands(input);
            assert_eq!(result.len(), 2);
        }

        #[test]
        fn test_split_unicode_input() {
            let _guard = test_guard!();
            let result = split_shell_commands("echo 'こんにちは' && cargo build");
            assert_eq!(result, vec!["echo 'こんにちは'", "cargo build"]);
        }

        #[test]
        fn test_split_extremely_long_input() {
            let _guard = test_guard!();
            // 20KB string should still work (split_shell_commands has no length limit)
            let long_cmd = format!("echo {} && cargo build", "x".repeat(20_000));
            let result = split_shell_commands(&long_cmd);
            assert_eq!(result.len(), 2);
        }

        #[test]
        fn test_classify_long_input_skips_splitting() {
            let _guard = test_guard!();
            // Commands >10KB skip multi-command splitting in classify_command
            let long_cmd = format!("cargo build && echo {}", "x".repeat(11_000));
            let result = classify_command(&long_cmd);
            // Falls through to single-command classification which rejects at check_structure
            assert!(!result.is_compilation);
            assert!(
                result.reason.to_string().contains("chained"),
                "long input should be rejected by check_structure, not split"
            );
        }

        #[test]
        fn test_split_only_operators() {
            let _guard = test_guard!();
            // Just operators with no commands
            let result = split_shell_commands("&& || ;");
            assert!(
                result.is_empty(),
                "only operators should yield empty result"
            );
        }

        #[test]
        fn test_split_consecutive_operators() {
            let _guard = test_guard!();
            let result = split_shell_commands("cargo build && && echo done");
            // Middle empty segment is dropped, yielding 2 segments
            assert_eq!(result, vec!["cargo build", "echo done"]);
        }

        #[test]
        fn test_classify_empty_after_split() {
            let _guard = test_guard!();
            // All sub-commands are non-compilation
            let result = classify_command("echo hello && ls -la || pwd");
            assert!(!result.is_compilation);
        }

        // =================== comprehensive multi-command tests (bd-1q0e) ===================

        // --- Split edge cases ---

        #[test]
        fn test_split_three_segment_chain() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("cd /proj && cmake .. && make"),
                vec!["cd /proj", "cmake ..", "make"]
            );
        }

        #[test]
        fn test_split_single_with_flags() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("cargo build --release"),
                vec!["cargo build --release"]
            );
        }

        #[test]
        fn test_split_nested_quotes_semicolon() {
            let _guard = test_guard!();
            assert_eq!(
                split_shell_commands("echo \"it's && done\" && make"),
                vec!["echo \"it's && done\"", "make"]
            );
        }

        #[test]
        fn test_split_pipe_then_and() {
            let _guard = test_guard!();
            // Single pipe within segment, && between segments
            assert_eq!(
                split_shell_commands("make 2>&1 | grep error && echo done"),
                vec!["make 2>&1 | grep error", "echo done"]
            );
        }

        #[test]
        fn test_split_leading_operator() {
            let _guard = test_guard!();
            // Leading && with nothing before
            assert_eq!(split_shell_commands("&& cargo build"), vec!["cargo build"]);
        }

        // --- Compound command classification tests ---
        // Compound && commands with compilation suffix are now ACCEPTED
        // This enables patterns like "cd /path && cargo build"

        #[test]
        fn test_classify_cargo_fmt_and_build() {
            let _guard = test_guard!();
            // Last segment is "cargo build" (compilation) → accepted
            let result = classify_command("cargo fmt && cargo build");
            assert!(
                result.is_compilation,
                "compound command with compilation suffix should be accepted"
            );
            assert!(result.reason.contains("compound"));
        }

        #[test]
        fn test_classify_cd_and_make() {
            let _guard = test_guard!();
            // Last segment is "make -j8" (compilation) → accepted
            let result = classify_command("cd /project && make -j8");
            assert!(
                result.is_compilation,
                "compound command with compilation suffix should be accepted"
            );
            assert!(result.reason.contains("compound"));
        }
        #[test]
        fn test_classify_export_and_cargo_build() {
            let _guard = test_guard!();
            // Last segment is "cargo build --release" (compilation) → accepted
            let result =
                classify_command("export RUSTFLAGS='-C opt-level=3' && cargo build --release");
            assert!(
                result.is_compilation,
                "compound command with compilation suffix should be accepted"
            );
            assert!(result.reason.contains("compound"));
        }
        #[test]
        fn test_classify_mkdir_cmake_chain() {
            let _guard = test_guard!();
            // Last segment is "cmake --build build" (compilation) → accepted
            let result =
                classify_command("mkdir -p build && cmake -B build && cmake --build build");
            assert!(
                result.is_compilation,
                "compound command with compilation suffix should be accepted"
            );
            assert!(result.reason.contains("compound"));
        }
        #[test]
        fn test_classify_echo_and_cargo_test() {
            let _guard = test_guard!();
            // Last segment is "cargo test" (compilation) → accepted
            let result = classify_command("echo 'Starting...' && cargo test");
            assert!(
                result.is_compilation,
                "compound command with compilation suffix should be accepted"
            );
            assert!(result.reason.contains("compound"));
        }
        #[test]
        fn test_classify_semicolon_chain_with_compilation() {
            let _guard = test_guard!();
            // Semicolon chains are NOT supported (only && is supported)
            let result = classify_command("cargo fmt; cargo build; cargo test");
            assert!(
                !result.is_compilation,
                "semicolon chained commands should be rejected"
            );
            assert!(result.reason.contains("chained"));
        }
        // --- Classification integration: should classify as NON-COMPILATION ---

        #[test]
        fn test_classify_echo_chain_non_compilation() {
            let _guard = test_guard!();
            let result = classify_command("echo hello && echo world");
            assert!(!result.is_compilation);
        }

        #[test]
        fn test_classify_ls_cat_non_compilation() {
            let _guard = test_guard!();
            let result = classify_command("ls -la && cat file.txt");
            assert!(!result.is_compilation);
        }

        #[test]
        fn test_classify_git_chain_non_compilation() {
            let _guard = test_guard!();
            let result = classify_command("git status && git log");
            assert!(!result.is_compilation);
        }

        // --- Performance test ---

        #[test]
        fn test_classify_multi_command_performance() {
            let _guard = test_guard!();
            let start = std::time::Instant::now();
            for _ in 0..100 {
                let _ = classify_command("cargo fmt && cargo build && cargo test");
            }
            let elapsed = start.elapsed();
            let per_call_us = elapsed.as_micros() / 100;
            // Each classify_command call should be well under 5ms
            assert!(
                per_call_us < 5_000,
                "classify_command took {}us per call, should be <5000us",
                per_call_us
            );
            eprintln!(
                "[perf] classify_command multi-command: {}us avg per call",
                per_call_us
            );
        }

        // --- Pipe preservation with split ---

        #[test]
        fn test_classify_pipe_to_pager_preserved() {
            let _guard = test_guard!();
            // Issue #24: a compilation command piped into a benign pager is
            // offloaded with the pipe re-attached to the offloaded output.
            let result = classify_command("cargo build 2>&1 | tee log");
            assert!(result.is_compilation, "got: {:?}", result.reason);
            assert_eq!(
                result.extracted_command.as_deref(),
                Some("cargo build 2>&1 | tee log")
            );
        }

        #[test]
        fn test_classify_pipe_segment_and_operator() {
            let _guard = test_guard!();
            // Pipe within first segment, && separates from second
            let result = classify_command("make 2>&1 | grep error && cargo build");
            // Should be rejected due to chaining (&&) AND piping (|)
            assert!(
                !result.is_compilation,
                "chained commands should be rejected"
            );
            // The reason will likely be "chained command (&&)" because check_structure checks separators first or pipes first?
            // Let's check check_structure impl: pipes are checked AFTER backgrounding, separators are after pipes?
            // Actually, check_structure checks pipes, then redirects, then chaining.
            // So "piped command" might be the reason. Either is fine.
            assert!(result.reason.contains("piped") || result.reason.contains("chained"));
        }
    }

    // =========================================================================
    // WS2.4: Zero-allocation reject path tests (bd-3mog)
    //
    // Verify that the Cow<'static, str> conversion in Classification and
    // ClassificationTier produces Cow::Borrowed on the reject path (zero heap
    // allocations) and that serde roundtrips work correctly.
    // =========================================================================

    /// Helper: assert that a Cow is the Borrowed variant (no heap allocation).
    /// We need the actual &Cow to distinguish Borrowed from Owned.
    #[allow(clippy::ptr_arg)]
    fn assert_cow_borrowed(cow: &Cow<'static, str>, context: &str) {
        assert!(
            matches!(cow, Cow::Borrowed(_)),
            "{context}: expected Cow::Borrowed, got Cow::Owned({:?})",
            cow,
        );
    }

    // --- 1. Classification correctness after Cow conversion ---

    #[test]
    fn test_cow_reject_empty_command_correctness() {
        let _guard = test_guard!();
        let result = classify_command("");
        assert!(!result.is_compilation);
        assert_eq!(result.confidence, 0.0);
        assert_eq!(result.kind, None);
        assert!(result.reason.contains("empty"), "reason: {}", result.reason);
    }

    #[test]
    fn test_cow_reject_non_compilation_commands() {
        let _guard = test_guard!();
        let non_compilation = [
            "ls -la",
            "cat file.txt",
            "echo hello",
            "git status",
            "pwd",
            "cd /tmp",
        ];
        for cmd in non_compilation {
            let result = classify_command(cmd);
            assert!(
                !result.is_compilation,
                "'{cmd}' should NOT be classified as compilation"
            );
            assert_eq!(result.confidence, 0.0, "'{cmd}' should have 0.0 confidence");
            assert_eq!(result.kind, None, "'{cmd}' should have no CompilationKind");
            assert!(!result.reason.is_empty(), "'{cmd}' should have a reason");
        }
    }

    #[test]
    fn test_cow_accept_compilation_commands() {
        let _guard = test_guard!();
        let cases: &[(&str, CompilationKind)] = &[
            ("cargo build", CompilationKind::CargoBuild),
            ("cargo test", CompilationKind::CargoTest),
            ("cargo check", CompilationKind::CargoCheck),
            ("cargo clippy", CompilationKind::CargoClippy),
            ("gcc -o hello hello.c", CompilationKind::Gcc),
            ("make", CompilationKind::Make),
            ("bun test", CompilationKind::BunTest),
        ];
        for &(cmd, expected_kind) in cases {
            let result = classify_command(cmd);
            assert!(
                result.is_compilation,
                "'{cmd}' should be classified as compilation"
            );
            assert_eq!(
                result.kind,
                Some(expected_kind),
                "'{cmd}' should have kind {expected_kind:?}"
            );
            assert!(
                result.confidence > 0.0,
                "'{cmd}' should have positive confidence"
            );
            assert!(!result.reason.is_empty(), "'{cmd}' should have a reason");
        }
    }

    // --- 2. Zero-allocation verification on reject path ---

    #[test]
    fn test_cow_borrowed_on_tier0_reject() {
        let _guard = test_guard!();
        // Empty command -> Tier 0 instant reject
        let result = classify_command("");
        assert_cow_borrowed(&result.reason, "Tier 0 empty command reason");
    }

    #[test]
    fn test_cow_borrowed_on_tier1_reject() {
        let _guard = test_guard!();
        // Pipe into a NON-benign command -> Tier 1 structure analysis reject
        // (benign pagers like tee/head are now offloaded per issue #24).
        let result = classify_command("cargo build | xargs rm");
        assert!(!result.is_compilation);
        assert_cow_borrowed(&result.reason, "Tier 1 piped command reason");

        // Input redirect -> still rejected (transforms the command's INPUT)
        let result = classify_command("cargo build < input.txt");
        assert!(!result.is_compilation);
        assert_cow_borrowed(&result.reason, "Tier 1 input redirect reason");

        // Subshell -> still rejected
        let result = classify_command("cargo build $(echo args)");
        assert!(!result.is_compilation);
        assert_cow_borrowed(&result.reason, "Tier 1 subshell reason");
    }

    #[test]
    fn test_cow_borrowed_on_tier2_reject() {
        let _guard = test_guard!();
        // Commands with no compilation keyword -> Tier 2 keyword filter reject
        let non_keyword_commands = [
            "ls -la",
            "cat file.txt",
            "echo hello world",
            "git status",
            "pwd",
            "cd /tmp",
            "grep pattern file",
            "find . -name '*.rs'",
            "cp src dst",
            "rm file.txt",
        ];
        for cmd in non_keyword_commands {
            let result = classify_command(cmd);
            assert!(!result.is_compilation, "'{cmd}' should be rejected");
            assert_cow_borrowed(&result.reason, &format!("Tier 2 reject for '{cmd}'"));
        }
    }

    #[test]
    fn test_cow_borrowed_on_tier3_reject() {
        let _guard = test_guard!();
        // Never-intercept commands now use static strings for performance (no format! allocation)
        let never_intercept = ["cargo fmt", "cargo install ripgrep", "cargo clean"];
        for cmd in never_intercept {
            let result = classify_command(cmd);
            assert!(!result.is_compilation, "'{cmd}' should be rejected");
            assert!(
                result.reason.contains("never-intercept"),
                "'{cmd}' reason should mention never-intercept: {}",
                result.reason
            );
            // Tier 3 now uses static string for performance -> Cow::Borrowed
            assert_cow_borrowed(&result.reason, &format!("Tier 3 reject for '{cmd}'"));
        }
    }

    // --- 3. ClassificationDetails tier Cow verification ---

    #[test]
    fn test_detailed_tiers_use_borrowed_names() {
        let _guard = test_guard!();
        // classify_command_detailed produces ClassificationTier entries
        // All tier names should be Cow::Borrowed (static constants)
        let details = classify_command_detailed("ls -la");
        for tier in &details.tiers {
            assert_cow_borrowed(&tier.name, &format!("Tier {} name", tier.tier));
        }
    }

    #[test]
    fn test_detailed_tier_reasons_borrowed_on_reject() {
        let _guard = test_guard!();
        // Non-compilation commands should have Cow::Borrowed reasons on all tiers
        let details = classify_command_detailed("ls -la");
        assert!(!details.classification.is_compilation);
        for tier in &details.tiers {
            assert_cow_borrowed(
                &tier.reason,
                &format!("Tier {} reason for 'ls -la'", tier.tier),
            );
        }
    }

    #[test]
    fn test_detailed_compilation_tier_names_borrowed() {
        let _guard = test_guard!();
        // Even for compilation commands, tier NAMES should always be Cow::Borrowed
        let details = classify_command_detailed("cargo build");
        assert!(details.classification.is_compilation);
        for tier in &details.tiers {
            assert_cow_borrowed(
                &tier.name,
                &format!("Tier {} name for 'cargo build'", tier.tier),
            );
        }
    }

    // --- 4. Serde roundtrip tests for Cow fields ---

    #[test]
    fn test_classification_serde_roundtrip_borrowed() {
        let _guard = test_guard!();
        let original = Classification::not_compilation("no compilation keyword");
        assert_cow_borrowed(&original.reason, "before serialize");

        let json = serde_json::to_string(&original).expect("serialize");
        let deserialized: Classification = serde_json::from_str(&json).expect("deserialize");

        assert_eq!(deserialized.is_compilation, original.is_compilation);
        assert_eq!(deserialized.confidence, original.confidence);
        assert_eq!(deserialized.kind, original.kind);
        assert_eq!(deserialized.reason, original.reason);
        // Note: after deserialization, Cow will be Owned (serde deserializes into String)
        // This is correct behavior — only the pre-serialization path needs to be allocation-free
    }

    #[test]
    fn test_classification_serde_roundtrip_compilation() {
        let _guard = test_guard!();
        let original =
            Classification::compilation(CompilationKind::CargoBuild, 0.95, "cargo build detected");

        let json = serde_json::to_string(&original).expect("serialize");
        let deserialized: Classification = serde_json::from_str(&json).expect("deserialize");

        assert_eq!(deserialized.is_compilation, original.is_compilation);
        assert_eq!(deserialized.confidence, original.confidence);
        assert_eq!(deserialized.kind, original.kind);
        assert_eq!(deserialized.reason.as_ref(), original.reason.as_ref());
    }

    #[test]
    fn test_classification_tier_serde_roundtrip() {
        let _guard = test_guard!();
        let tier = ClassificationTier {
            tier: 2,
            name: Cow::Borrowed(TIER_KEYWORD_FILTER),
            decision: TierDecision::Reject,
            reason: Cow::Borrowed("no compilation keyword"),
        };
        assert_cow_borrowed(&tier.name, "tier name before serialize");
        assert_cow_borrowed(&tier.reason, "tier reason before serialize");

        let json = serde_json::to_string(&tier).expect("serialize");
        let deserialized: ClassificationTier = serde_json::from_str(&json).expect("deserialize");

        assert_eq!(deserialized.tier, tier.tier);
        assert_eq!(deserialized.name.as_ref(), tier.name.as_ref());
        assert_eq!(deserialized.decision, tier.decision);
        assert_eq!(deserialized.reason.as_ref(), tier.reason.as_ref());
    }

    #[test]
    fn test_classification_details_serde_roundtrip() {
        let _guard = test_guard!();
        let details = classify_command_detailed("cargo build");
        assert!(details.classification.is_compilation);

        let json = serde_json::to_string(&details).expect("serialize");
        let deserialized: ClassificationDetails = serde_json::from_str(&json).expect("deserialize");

        assert_eq!(deserialized.original, details.original);
        assert_eq!(deserialized.normalized, details.normalized);
        assert_eq!(deserialized.tiers.len(), details.tiers.len());
        assert_eq!(
            deserialized.classification.is_compilation,
            details.classification.is_compilation
        );
        assert_eq!(
            deserialized.classification.kind,
            details.classification.kind
        );
    }

    // --- 5. Cow display and comparison tests ---

    #[test]
    fn test_cow_reason_display() {
        let _guard = test_guard!();
        let result = classify_command("ls");
        // Cow<str> should Display/Debug correctly
        let displayed = format!("{}", result.reason);
        assert!(!displayed.is_empty());
        let debugged = format!("{:?}", result.reason);
        assert!(!debugged.is_empty());
    }

    #[test]
    fn test_cow_reason_comparison() {
        let _guard = test_guard!();
        // Cow::Borrowed and Cow::Owned with same content should be equal
        let borrowed: Cow<'static, str> = Cow::Borrowed("no compilation keyword");
        let owned: Cow<'static, str> = Cow::Owned("no compilation keyword".to_string());
        assert_eq!(borrowed, owned);

        // Classification reasons should be comparable
        let r1 = classify_command("ls");
        let r2 = classify_command("pwd");
        // Both should be "no compilation keyword" (Tier 2 reject)
        assert_eq!(r1.reason, r2.reason);
    }
}

#[cfg(test)]
mod tests_bun_whitespace {
    use super::*;
    use crate::test_guard;

    #[test]
    fn test_bun_whitespace_resilience() {
        let _guard = test_guard!();

        // Standard single space
        let result = classify_command("bun test");
        assert!(result.is_compilation, "bun test failed");
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // Multiple spaces
        let result = classify_command("bun  test");
        assert!(result.is_compilation, "bun  test failed");
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // Tab separation
        let result = classify_command("bun\ttest");
        assert!(result.is_compilation, "bun\\ttest failed");
        assert_eq!(result.kind, Some(CompilationKind::BunTest));

        // Typecheck with extra spaces
        let result = classify_command("bun   typecheck   src/");
        assert!(result.is_compilation, "bun typecheck with spaces failed");
        assert_eq!(result.kind, Some(CompilationKind::BunTypecheck));
    }

    #[test]
    fn test_bun_watch_with_whitespace() {
        let _guard = test_guard!();

        // Watch with extra spaces
        let result = classify_command("bun  test  --watch");
        assert!(
            !result.is_compilation,
            "bun test --watch should be rejected"
        );
        assert!(result.reason.contains("interactive"));

        // Watch with short flag and tabs
        let result = classify_command("bun\ttypecheck\t-w");
        assert!(
            !result.is_compilation,
            "bun typecheck -w should be rejected"
        );
        assert!(result.reason.contains("interactive"));
    }

    #[test]
    fn test_bun_x_whitespace() {
        let _guard = test_guard!();

        // bun x with extra spaces
        let result = classify_command("bun  x  vitest");
        assert!(!result.is_compilation, "bun x should be rejected");
        assert!(result.reason.contains("bun x"));
    }
}

#[cfg(test)]
mod tests_normalize_whitespace {
    use super::*;
    use crate::test_guard;

    #[test]
    fn test_wrapper_whitespace_resilience() {
        let _guard = test_guard!();

        // Multiple spaces
        assert_eq!(normalize_command("sudo  cargo"), "cargo");

        // Tabs
        assert_eq!(normalize_command("sudo\tcargo"), "cargo");

        // Mixed wrappers with weird spacing
        assert_eq!(normalize_command("time\tsudo  cargo"), "cargo");

        // Prefix matching safety
        assert_eq!(normalize_command("sudocargo"), "sudocargo");

        // Bare wrapper (should become empty)
        assert_eq!(normalize_command("sudo"), "");
    }

    #[test]
    fn wrapper_value_flags_consume_their_value_token() {
        // Regression (bd-review-wrapper-flag-eater): value-taking wrapper flags
        // must consume the VALUE token too, or it is left as the command word
        // and a real build silently runs local.
        let _guard = test_guard!();
        assert_eq!(normalize_command("nice -n 10 cargo build"), "cargo build");
        assert_eq!(
            normalize_command("taskset -c 0-3 cargo build"),
            "cargo build"
        );
        assert_eq!(normalize_command("ionice -c 2 cargo test"), "cargo test");
        assert_eq!(
            normalize_command("ionice -c 2 -n 4 cargo build"),
            "cargo build"
        );
        assert_eq!(normalize_command("chrt -r 10 cargo build"), "cargo build");
        assert_eq!(normalize_command("timeout 60 cargo build"), "cargo build");
        assert_eq!(
            normalize_command("timeout -s KILL 90 cargo build"),
            "cargo build"
        );
        assert_eq!(
            normalize_command("sudo nice -n 5 cargo build"),
            "cargo build"
        );
        // Attached / `=`-joined values carry their own value (no extra consume).
        assert_eq!(normalize_command("nice -n10 cargo build"), "cargo build");
        assert_eq!(normalize_command("ionice -c2 cargo build"), "cargo build");
        // Existing env -u behavior preserved.
        assert_eq!(
            normalize_command("env -u RUSTFLAGS cargo build"),
            "cargo build"
        );
    }

    #[test]
    fn positional_wrapper_does_not_eat_a_non_numeric_command() {
        // Malformed `timeout cargo build` (no duration): the leading non-digit
        // token is the command and must NOT be skipped.
        let _guard = test_guard!();
        assert_eq!(normalize_command("timeout cargo build"), "cargo build");
    }

    #[test]
    fn wrapped_cargo_build_is_still_classified_as_compilation() {
        let _guard = test_guard!();
        for cmd in [
            "nice -n 10 cargo build",
            "taskset -c 0-3 cargo build",
            "ionice -c 2 cargo build",
            "chrt -r 10 cargo build",
            "timeout 60 cargo build",
            "timeout -s KILL 90 cargo test",
            "time '-f%U' cargo build",
            "time \"-f%U\" cargo build",
            "nice '--adjustment=+5' cargo build",
            "nice '-n' '5' cargo build",
            "env '--unset' 'RUSTFLAGS' cargo build",
        ] {
            assert!(
                classify_command(cmd).is_compilation,
                "wrapper must not defeat offload: {cmd}"
            );
        }
        // A wrapper around a non-build must still pass through (not offloaded).
        assert!(!classify_command("nice -n 10 ls -la").is_compilation);
        assert!(!classify_command("timeout 60 echo hi").is_compilation);
        assert!(!classify_command("time '-f%U' echo cargo build").is_compilation);
        assert!(!classify_command("time '-f%U cargo build").is_compilation);
        assert!(!classify_command("time '-f%U'echo cargo build").is_compilation);
    }

    #[test]
    fn test_env_var_whitespace() {
        let _guard = test_guard!();

        for (cmd, normalized) in [
            // env with multiple spaces before VAR
            ("env  RUST_BACKTRACE=1 cargo", "cargo"),
            // env with tabs
            ("env\tRUST_BACKTRACE=1\tcargo", "cargo"),
            ("env -u RUST_LOG cargo test", "cargo test"),
            ("env --unset RUST_LOG cargo test", "cargo test"),
            ("env --unset=RUST_LOG cargo test", "cargo test"),
        ] {
            assert_eq!(normalize_command(cmd), normalized, "{cmd}");
        }
    }
}

// ============================================================================
// REGRESSION SUITE: Command Classification (bd-vvmd.2.9)
//
// Table-driven regression tests protecting non-compilation UX. Every entry
// documents expected behavior with rationale so accidental interception of
// local-only commands is caught immediately.
// ============================================================================

#[cfg(test)]
mod regression_classification {
    use super::*;
    use crate::test_guard;

    fn assert_golden_json(
        actual: serde_json::Value,
        expected: &serde_json::Value,
        fixture_path: &str,
    ) {
        if &actual == expected {
            return;
        }

        let actual_json = serde_json::to_string_pretty(&actual).expect("actual JSON renders");
        let expected_json = serde_json::to_string_pretty(expected).expect("expected JSON renders");
        panic!(
            "golden mismatch in {fixture_path}\n\
             expected_blake3={}\n\
             actual_blake3={}\n\
             bless path: review the semantic diff, update the fixture expected_* field, \
             and record both hashes in the Beads closeout.\n\
             expected:\n{expected_json}\n\
             actual:\n{actual_json}",
            blake3::hash(expected_json.as_bytes()),
            blake3::hash(actual_json.as_bytes())
        );
    }

    /// A single regression test case.
    struct Case {
        cmd: &'static str,
        expect_compilation: bool,
        expected_kind: Option<CompilationKind>,
        /// Substring that MUST appear in the classification reason.
        reason_contains: &'static str,
        /// Minimum confidence (only checked when expect_compilation is true).
        min_confidence: f64,
    }

    fn run_cases(cases: &[Case]) {
        for (i, c) in cases.iter().enumerate() {
            let result = classify_command(c.cmd);
            assert_eq!(
                result.is_compilation, c.expect_compilation,
                "Case {i} ({:?}): expected is_compilation={}, got={}. reason={:?}",
                c.cmd, c.expect_compilation, result.is_compilation, result.reason
            );
            if c.expect_compilation {
                assert_eq!(
                    result.kind, c.expected_kind,
                    "Case {i} ({:?}): expected kind={:?}, got={:?}",
                    c.cmd, c.expected_kind, result.kind
                );
                assert!(
                    result.confidence >= c.min_confidence,
                    "Case {i} ({:?}): expected confidence >= {}, got={}",
                    c.cmd,
                    c.min_confidence,
                    result.confidence
                );
            }
            if !c.reason_contains.is_empty() {
                assert!(
                    result.reason.contains(c.reason_contains),
                    "Case {i} ({:?}): expected reason containing {:?}, got {:?}",
                    c.cmd,
                    c.reason_contains,
                    result.reason
                );
            }
        }
    }

    // ------------------------------------------------------------------
    // 1. Cargo: Positive compilation commands
    // ------------------------------------------------------------------

    #[test]
    fn regression_cargo_compilation_positive() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "cargo build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo build --release",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo build --workspace",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo build -p my-crate",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo b",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test --release",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test my_test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test -- --nocapture",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test --workspace",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test -p rch-common",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo t",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test --lib",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test --bins",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test --doc",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo test -- --test-threads=4",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo check",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoCheck),
                reason_contains: "cargo check",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo check --workspace --all-targets",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoCheck),
                reason_contains: "cargo check",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo c",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoCheck),
                reason_contains: "cargo check",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo clippy",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoClippy),
                reason_contains: "cargo clippy",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo clippy --workspace --all-targets -- -D warnings",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoClippy),
                reason_contains: "cargo clippy",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo doc",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoDoc),
                reason_contains: "cargo doc",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cargo doc --no-deps",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoDoc),
                reason_contains: "cargo doc",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cargo run",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo run",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cargo run --release",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo run",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cargo r",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo run",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cargo bench",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBench),
                reason_contains: "cargo bench",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo bench --bench my_bench",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBench),
                reason_contains: "cargo bench",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo nextest run",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoNextest),
                reason_contains: "cargo nextest run",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo nextest run --workspace",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoNextest),
                reason_contains: "cargo nextest run",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo nextest r",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoNextest),
                reason_contains: "cargo nextest run",
                min_confidence: 0.90,
            },
            // Toolchain override variants
            Case {
                cmd: "cargo +nightly build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo +1.80.0 test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo +nightly nextest run",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoNextest),
                reason_contains: "cargo nextest run",
                min_confidence: 0.90,
            },
            // Leading global flags before the subcommand must NOT hide the build
            // (regression for the flag-read-as-subcommand misclassification).
            Case {
                cmd: "cargo --offline build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo -q test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo --locked --frozen check",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoCheck),
                reason_contains: "cargo check",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo --color never build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "cargo +nightly --offline -Z unstable-options build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            // `rch exec` re-quotes every word containing `=` (shell_words::join).
            Case {
                cmd: "cargo '--config=build.jobs=2' -vvv clippy",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoClippy),
                reason_contains: "cargo clippy",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cargo-zigbuild '--color=never' zigbuild",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoZigbuild),
                reason_contains: "cargo-zigbuild build",
                min_confidence: 0.90,
            },
            // A quoted word is still read by its content, never as a flag.
            Case {
                cmd: "cargo 'fetch'",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    #[test]
    fn regression_cargo_package_verification_is_compilation() {
        let _guard = test_guard!();
        for command in [
            "cargo package",
            "cargo package --workspace --locked -j2",
            "cargo package -p asupersync --features tls --target x86_64-unknown-linux-gnu",
            "cargo +nightly --offline package --allow-dirty --no-metadata",
            "cargo --color never package --target-dir=/data/tmp/package-check",
            "cargo publish --dry-run",
            "cargo publish -n --workspace --locked --keep-going -j 2",
            "cargo publish --registry crates-io -p asupersync --dry-run",
            "cargo +nightly --locked publish --dry-run --features=tls",
            "env CARGO_INCREMENTAL=0 cargo publish --dry-run --workspace",
        ] {
            let classification = classify_command(command);
            assert!(
                classification.is_compilation,
                "{command}: {classification:?}"
            );
            assert_eq!(classification.kind, Some(CompilationKind::CargoBuild));
            assert_eq!(
                classify_command_detailed(command).classification,
                classification,
                "diagnosis must agree with execution for {command}"
            );
        }
    }

    #[test]
    fn regression_cargo_package_verification_declines_publication_and_metadata() {
        let _guard = test_guard!();
        for command in [
            "cargo publish",
            "cargo publish --workspace --locked",
            "cargo +nightly --offline publish",
            "cargo publish --no-verify",
            "cargo publish --dry-run --no-verify",
            "cargo publish --no-verify -n",
            "cargo publish -qn --no-verify",
            "cargo package --no-verify",
            "cargo package --list",
            "cargo package -l",
            "cargo package -vl",
            "cargo package --help",
            "cargo --help package",
            "cargo publish --dry-run -h",
            "cargo publish -- --dry-run",
            "cargo publish --dry-run -- --no-verify",
            "cargo publish --dry-run=false",
            "cargo publish --registry=--dry-run",
            "cargo publish -p--dry-run",
            "cargo publish --token=--dry-run",
            "cargo publish --config --dry-run",
            "cargo publish --config alias.note=--dry-run",
            "cargo publish --unknown-option --dry-run",
            "cargo package --target --no-verify",
            "cargo package --package --list",
            "cargo package --config",
            "cargo publish --config 'alias.note=\"--dry-run\"'",
            "cargo publish --registry 'example --dry-run registry'",
            "cargo publish --dry-run --config 'alias.note=\"--no-verify\"'",
            "cargo publish --dry-run $EXTRA_CARGO_OPTIONS",
        ] {
            let classification = classify_command(command);
            assert!(
                !classification.is_compilation,
                "{command}: {classification:?}"
            );
            let detailed = classify_command_detailed(command).classification;
            assert!(!detailed.is_compilation, "{command}: {detailed:?}");
            assert!(!is_cargo_package_verification(command), "{command}");
        }
    }

    // ------------------------------------------------------------------
    // 2. Cargo: Negative (NEVER intercept — must stay local)
    // ------------------------------------------------------------------

    #[test]
    fn regression_cargo_never_intercept() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "cargo install ripgrep",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo publish",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo login",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo fmt",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo fmt --check",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo fix",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo clean",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo new my_project",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo init",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo add serde",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo remove serde",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo update",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo generate-lockfile",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo watch -x test",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo -V",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            // cargo nextest non-run subcommands
            Case {
                cmd: "cargo nextest list",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo nextest archive",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo nextest show",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            // Bare cargo / bare cargo nextest
            Case {
                cmd: "cargo",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "bare cargo",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo nextest",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "bare cargo nextest",
                min_confidence: 0.0,
            },
            // Non-interceptable subcommands
            Case {
                cmd: "cargo tree",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "not interceptable",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo metadata",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "not interceptable",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo search serde",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "not interceptable",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo vendor",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "not interceptable",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 3. Bun: Positive compilation (test, typecheck)
    // ------------------------------------------------------------------

    #[test]
    fn regression_bun_compilation_positive() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "bun test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTest),
                reason_contains: "bun test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "bun test src/",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTest),
                reason_contains: "bun test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "bun test --bail",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTest),
                reason_contains: "bun test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "bun test --timeout 5000",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTest),
                reason_contains: "bun test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "bun typecheck",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTypecheck),
                reason_contains: "bun typecheck",
                min_confidence: 0.90,
            },
            Case {
                cmd: "bun typecheck src/",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::BunTypecheck),
                reason_contains: "bun typecheck",
                min_confidence: 0.90,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 4. Bun: Negative (package management, execution, interactive)
    // ------------------------------------------------------------------

    #[test]
    fn regression_bun_never_intercept() {
        let _guard = test_guard!();
        let cases = [
            // Package management — modifies local node_modules
            Case {
                cmd: "bun install",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun add react",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun remove react",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun link",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun unlink",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun pm ls",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun init",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun create my-app",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun upgrade",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            // Execution — binds local ports or runs scripts
            Case {
                cmd: "bun run dev",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun build src/index.ts",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun dev",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun repl",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            // Package runner — arbitrary execution like npx
            Case {
                cmd: "bun x vitest",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "bun x",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun x tsc --noEmit",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "bun x",
                min_confidence: 0.0,
            },
            // Interactive watch modes — must run locally for interactivity
            Case {
                cmd: "bun test --watch",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "interactive",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun test -w",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "interactive",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun typecheck --watch",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "interactive",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun typecheck -w",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "interactive",
                min_confidence: 0.0,
            },
            // Version/help
            Case {
                cmd: "bun --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun -v",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun --help",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun -h",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "bun completions",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 5. C/C++ compilers: Positive compilation
    // ------------------------------------------------------------------

    #[test]
    fn regression_c_cpp_compilation_positive() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "gcc -c main.c -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gcc),
                reason_contains: "gcc",
                min_confidence: 0.85,
            },
            Case {
                cmd: "gcc main.c -o main",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gcc),
                reason_contains: "gcc",
                min_confidence: 0.85,
            },
            Case {
                cmd: "g++ -c main.cpp -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gpp),
                reason_contains: "g++",
                min_confidence: 0.85,
            },
            Case {
                cmd: "g++ main.cc -o main",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gpp),
                reason_contains: "g++",
                min_confidence: 0.85,
            },
            Case {
                cmd: "clang -c main.c -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Clang),
                reason_contains: "clang",
                min_confidence: 0.85,
            },
            Case {
                cmd: "clang++ -c main.cpp -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Clangpp),
                reason_contains: "clang++",
                min_confidence: 0.85,
            },
            Case {
                cmd: "clang++ main.cc -o main",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Clangpp),
                reason_contains: "clang++",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cc -c main.c -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gcc),
                reason_contains: "cc",
                min_confidence: 0.80,
            },
            Case {
                cmd: "c++ -c main.cpp -o main.o",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Gpp),
                reason_contains: "c++",
                min_confidence: 0.80,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 6. C/C++ compilers: Version checks (NEVER intercept)
    // ------------------------------------------------------------------

    #[test]
    fn regression_c_cpp_version_checks_not_intercepted() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "rustc --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "rustc -V",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "gcc --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "gcc -v",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "clang --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "clang -v",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "make --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "make -v",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cmake --version",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "never-intercept",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 7. Build systems: Positive compilation
    // ------------------------------------------------------------------

    #[test]
    fn regression_build_systems_positive() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "make",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Make),
                reason_contains: "make build",
                min_confidence: 0.80,
            },
            Case {
                cmd: "make -j8",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Make),
                reason_contains: "make build",
                min_confidence: 0.80,
            },
            Case {
                cmd: "make all",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Make),
                reason_contains: "make build",
                min_confidence: 0.80,
            },
            Case {
                cmd: "cmake --build build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CmakeBuild),
                reason_contains: "cmake --build",
                min_confidence: 0.85,
            },
            Case {
                cmd: "cmake --build=build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CmakeBuild),
                reason_contains: "cmake --build",
                min_confidence: 0.85,
            },
            Case {
                cmd: "ninja",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Ninja),
                reason_contains: "ninja build",
                min_confidence: 0.85,
            },
            Case {
                cmd: "ninja -j4",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Ninja),
                reason_contains: "ninja build",
                min_confidence: 0.85,
            },
            Case {
                cmd: "meson compile",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Meson),
                reason_contains: "meson compile",
                min_confidence: 0.80,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 8. Build systems: Negative (clean, install, version)
    // ------------------------------------------------------------------

    #[test]
    fn regression_build_systems_not_intercepted() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "make clean",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "make maintenance",
                min_confidence: 0.0,
            },
            Case {
                cmd: "make install",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "make maintenance",
                min_confidence: 0.0,
            },
            Case {
                cmd: "make distclean",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "make maintenance",
                min_confidence: 0.0,
            },
            Case {
                cmd: "ninja -t clean",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "ninja clean",
                min_confidence: 0.0,
            },
            Case {
                cmd: "ninja clean",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "ninja clean",
                min_confidence: 0.0,
            },
            // meson without compile subcommand
            Case {
                cmd: "meson setup build",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no matching pattern",
                min_confidence: 0.0,
            },
            Case {
                cmd: "meson configure",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no matching pattern",
                min_confidence: 0.0,
            },
            // cmake without --build
            Case {
                cmd: "cmake .",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no matching pattern",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cmake -DCMAKE_BUILD_TYPE=Release ..",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no matching pattern",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 9. Rustc: Direct invocation
    // ------------------------------------------------------------------

    #[test]
    fn regression_rustc_positive() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "rustc main.rs",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Rustc),
                reason_contains: "rustc",
                min_confidence: 0.90,
            },
            Case {
                cmd: "rustc main.rs -o main",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Rustc),
                reason_contains: "rustc",
                min_confidence: 0.90,
            },
            Case {
                cmd: "rustc --edition 2021 main.rs",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::Rustc),
                reason_contains: "rustc",
                min_confidence: 0.90,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 10. Shell structure exclusions (pipes, redirects, bg, chains)
    // ------------------------------------------------------------------

    #[test]
    fn regression_shell_structure_exclusions() {
        let _guard = test_guard!();
        let cases = [
            // Pipe into a NON-benign command -> still rejected (issue #24 only
            // offloads pipes into benign pagers like tee/head/grep).
            Case {
                cmd: "cargo build 2>&1 | xargs rm",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "piped",
                min_confidence: 0.0,
            },
            // Input redirect
            Case {
                cmd: "cargo build < input.txt",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "input redirect",
                min_confidence: 0.0,
            },
            // Subshell
            Case {
                cmd: "(cargo build)",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "subshell",
                min_confidence: 0.0,
            },
            Case {
                cmd: "$(cargo build)",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "subshell",
                min_confidence: 0.0,
            },
            Case {
                cmd: "`cargo build`",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "subshell capture",
                min_confidence: 0.0,
            },
            // Process substitution
            Case {
                cmd: "cargo build --config <(echo ...)",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "subshell",
                min_confidence: 0.0,
            },
            // Semicolon chains
            Case {
                cmd: "cargo build; cargo test",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "chained",
                min_confidence: 0.0,
            },
            // || chains
            Case {
                cmd: "cargo build || echo failed",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "chained",
                min_confidence: 0.0,
            },
            // Newline injection (security)
            Case {
                cmd: "cargo build\nrm -rf /",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "newline",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cargo build\r\nevil",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "newline",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 10a. Every compilation segment of an `&&` chain is offloaded (issue #50).
    //
    // `cargo build --release && cargo test` used to rewrite only the final
    // segment; the first build ran locally on the dispatcher with no summary
    // line. Now every segment that classifies as a compilation is wrapped.
    // ------------------------------------------------------------------

    #[test]
    fn regression_compound_chain_offloads_every_compilation_segment() {
        let _guard = test_guard!();

        let result = classify_command("cargo build --release && cargo test");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
        assert_eq!(
            result.command_prefix.as_deref(),
            Some("rch exec -- cargo build --release && ")
        );
        assert_eq!(result.extracted_command.as_deref(), Some("cargo test"));

        // Three segments, non-compilation head: only the builds are wrapped.
        let result = classify_command("touch marker && cargo build && cargo test --workspace");
        assert_eq!(
            result.command_prefix.as_deref(),
            Some("touch marker && rch exec -- cargo build && ")
        );
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo test --workspace")
        );

        // Mixed tool families are each wrapped.
        let result = classify_command("go vet ./... && cargo check");
        assert_eq!(
            result.command_prefix.as_deref(),
            Some("rch exec -- go vet ./... && ")
        );

        // Existing contract: a plain `cd` prefix is untouched.
        let result = classify_command("cd /repo && cargo build");
        assert_eq!(result.command_prefix.as_deref(), Some("cd /repo && "));

        // A build-looking segment that must stay local is left verbatim ...
        let result = classify_command("go build -o app ./cmd && cargo test");
        assert!(result.is_compilation);
        assert_eq!(
            result.command_prefix.as_deref(),
            Some("go build -o app ./cmd && ")
        );
        // ... and reported, so the hook can announce it instead of staying silent.
        assert_eq!(
            compound_local_compilation_segments("go build -o app ./cmd && cargo test"),
            vec!["go build -o app ./cmd".to_string()]
        );
        assert!(
            compound_local_compilation_segments("cargo build --release && cargo test").is_empty()
        );
        assert!(compound_local_compilation_segments("cd /repo && cargo build").is_empty());
        assert!(compound_local_compilation_segments("cargo test").is_empty());
        assert!(
            compound_local_compilation_segments("bash -c \"cargo build && cargo test\"").is_empty(),
            "quoted operators are not chain separators"
        );

        // `;` / `||` chains and a chain whose final segment is not a build stay
        // declined, and each carries a structure reason the hook prints.
        assert!(!classify_command("cargo build ; cargo test").is_compilation);
        assert!(declined_compilation_due_to_structure("cargo build ; cargo test").is_some());
        assert!(declined_compilation_due_to_structure("cargo build || echo failed").is_some());
        assert!(declined_compilation_due_to_structure("cargo build && ./run").is_some());
    }

    // ------------------------------------------------------------------
    // 10b. Benign trailing structure IS offloaded (issue #24).
    //
    // A compilation command followed only by a benign stdout/stderr redirect,
    // a pipe into a benign pager (tee/head/cat/grep/less/...), or backgrounding
    // is now extracted and offloaded, with the trailing structure re-attached
    // to the offloaded command's output.
    // ------------------------------------------------------------------

    #[test]
    fn regression_benign_trailing_structure_offloaded() {
        let _guard = test_guard!();
        let expectations: &[(&str, CompilationKind, &str)] = &[
            // Output redirects
            (
                "cargo build > log.txt",
                CompilationKind::CargoBuild,
                "cargo build > log.txt",
            ),
            (
                "cargo build >> log.txt",
                CompilationKind::CargoBuild,
                "cargo build >> log.txt",
            ),
            (
                "cargo test --workspace > out.log 2>&1",
                CompilationKind::CargoTest,
                "cargo test --workspace > out.log 2>&1",
            ),
            // Pipes into benign pagers
            (
                "cargo build 2>&1 | grep error",
                CompilationKind::CargoBuild,
                "cargo build 2>&1 | grep error",
            ),
            (
                "cargo test | tee output.log",
                CompilationKind::CargoTest,
                "cargo test | tee output.log",
            ),
            (
                "cargo check --lib 2>&1 | head",
                CompilationKind::CargoCheck,
                "cargo check --lib 2>&1 | head",
            ),
            // Backgrounding
            (
                "cargo build &",
                CompilationKind::CargoBuild,
                "cargo build &",
            ),
        ];
        for (cmd, kind, extracted) in expectations {
            let result = classify_command(cmd);
            assert!(
                result.is_compilation,
                "'{cmd}' should be offloaded, got: {:?}",
                result.reason
            );
            assert_eq!(result.kind, Some(*kind), "kind mismatch for '{cmd}'");
            assert_eq!(
                result.extracted_command.as_deref(),
                Some(*extracted),
                "extracted command mismatch for '{cmd}'"
            );
            // command_prefix is empty for benign-suffix (no leading prefix).
            assert_eq!(result.command_prefix.as_deref(), Some(""));
        }
    }

    #[test]
    fn regression_unsafe_trailing_structure_still_rejected() {
        let _guard = test_guard!();
        // Stay conservative: these forms transform input / chain a build / pipe
        // into a non-pager, and must NOT be offloaded.
        let rejected = [
            "cargo build < input.txt",           // input redirect
            "cargo build | xargs rm",            // non-benign pipe target
            "cargo build 2>&1 | grep e | sh",    // multi-stage pipe
            "cargo test | tee log && cargo run", // chained build
            "cargo build > a.log < in.txt",      // input redirect present
        ];
        for cmd in rejected {
            let result = classify_command(cmd);
            assert!(
                !result.is_compilation,
                "'{cmd}' should NOT be offloaded, got: {:?}",
                result
            );
        }
    }

    #[test]
    fn regression_shell_dash_c_wrapper_offloaded() {
        let _guard = test_guard!();
        // Issue #24 item 2: bash -c / sh -c wrappers extract the inner command.
        let result = classify_command("bash -c \"cargo test --workspace\"");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo test --workspace")
        );

        let result = classify_command("sh -c 'cargo build --release'");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo build --release")
        );

        // Absolute-path shell.
        let result = classify_command("/bin/bash -c \"cargo check\"");
        assert!(result.is_compilation, "got: {:?}", result.reason);

        // Inner compound is preserved (cd prefix kept).
        let result = classify_command("bash -c \"cd /repo && cargo build\"");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo build"),
            "inner compound should keep extracted command"
        );
        assert_eq!(result.command_prefix.as_deref(), Some("cd /repo && "));

        // Inner benign suffix is preserved.
        let result = classify_command("bash -c \"cargo test > log 2>&1\"");
        assert!(result.is_compilation, "got: {:?}", result.reason);
        assert_eq!(
            result.extracted_command.as_deref(),
            Some("cargo test > log 2>&1")
        );

        // Non-compilation inner -> not intercepted.
        let result = classify_command("bash -c \"ls -la\"");
        assert!(!result.is_compilation);

        // Inner command that is itself a never-intercept stays declined.
        let result = classify_command("bash -c \"cargo fmt\"");
        assert!(!result.is_compilation);
    }

    // ------------------------------------------------------------------
    // 11. fd-to-fd redirects are SAFE and should NOT block interception
    // ------------------------------------------------------------------

    #[test]
    fn regression_fd_redirect_safe() {
        let _guard = test_guard!();
        // Compound: "cd /path && cargo build 2>&1" should detect cargo build
        // via compound command handling (depth-0 splits on &&, depth-1 checks segment)
        // Simple fd-to-fd redirect like "cargo build 2>&1" is handled by check_structure
        // which explicitly skips fd-to-fd redirects. So "cargo build 2>&1" should be
        // classified as compilation.
        let result = classify_command("cargo build 2>&1");
        assert!(
            result.is_compilation,
            "cargo build 2>&1 should be classified as compilation (fd redirect is safe), got: {:?}",
            result.reason
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
    }

    // ------------------------------------------------------------------
    // 12. Compound commands: && chains with compilation suffix
    // ------------------------------------------------------------------

    #[test]
    fn regression_compound_commands() {
        let _guard = test_guard!();
        // cd && cargo build should be detected as compilation
        let result = classify_command("cd /path && cargo build");
        assert!(
            result.is_compilation,
            "cd && cargo build should compile, got: {:?}",
            result.reason
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoBuild));
        assert!(result.command_prefix.is_some(), "should have prefix");
        assert!(
            result.extracted_command.is_some(),
            "should have extracted command"
        );

        let result = classify_command("cd /path && cargo test --workspace");
        assert!(
            result.is_compilation,
            "cd && cargo test should compile, got: {:?}",
            result.reason
        );
        assert_eq!(result.kind, Some(CompilationKind::CargoTest));

        // Non-compilation suffix should not match
        let result = classify_command("cd /path && cargo fmt");
        assert!(!result.is_compilation, "cd && cargo fmt should NOT compile");

        let result = classify_command("cd /path && ls -la");
        assert!(!result.is_compilation, "cd && ls should NOT compile");
    }

    // ------------------------------------------------------------------
    // 13. Wrapper normalization: env, sudo, time, etc.
    // ------------------------------------------------------------------

    #[test]
    fn regression_wrapper_normalization() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "sudo cargo build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "time cargo test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "env RUST_BACKTRACE=1 cargo test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "env -u RUST_LOG cargo test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "RUST_BACKTRACE=1 cargo test",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoTest),
                reason_contains: "cargo test",
                min_confidence: 0.90,
            },
            Case {
                cmd: "nice cargo build --release",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "/usr/bin/cargo build",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoBuild),
                reason_contains: "cargo build",
                min_confidence: 0.90,
            },
            Case {
                cmd: "sudo env RUSTFLAGS=-Dwarnings cargo clippy",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::CargoClippy),
                reason_contains: "cargo clippy",
                min_confidence: 0.85,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 14. Non-compilation commands (must never trigger)
    // ------------------------------------------------------------------

    #[test]
    fn regression_non_compilation_passthrough() {
        let _guard = test_guard!();
        let cases = [
            Case {
                cmd: "ls -la",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "pwd",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "echo hello",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cat Cargo.toml",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "git status",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "git commit -m 'fix'",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "npm install",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "yarn build",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "python main.py",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            // Go is now a first-class offload target (previously this asserted
            // "no compilation keyword", i.e. that `go build` was NOT intercepted
            // and therefore ran locally on the orchestrator).
            Case {
                cmd: "go build .",
                expect_compilation: true,
                expected_kind: Some(CompilationKind::GoBuild),
                reason_contains: "go build command",
                min_confidence: 0.9,
            },
            // …but an emitting `go build -o` still runs locally: Go kinds are
            // stream-only, so offloading it would leave no binary behind.
            Case {
                cmd: "go build -o bin/app ./cmd/app",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "emits a local binary",
                min_confidence: 0.0,
            },
            Case {
                cmd: "docker build -t myapp .",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "pip install -r requirements.txt",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "curl https://example.com",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "mkdir -p build",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "rm -rf target/",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "cp -r src/ backup/",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "no compilation keyword",
                min_confidence: 0.0,
            },
            Case {
                cmd: "",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "empty command",
                min_confidence: 0.0,
            },
            Case {
                cmd: "   ",
                expect_compilation: false,
                expected_kind: None,
                reason_contains: "empty command",
                min_confidence: 0.0,
            },
        ];
        run_cases(&cases);
    }

    // ------------------------------------------------------------------
    // 15. ClassificationDetails: structured log field verification
    // ------------------------------------------------------------------

    #[test]
    fn regression_classification_details_fields() {
        let _guard = test_guard!();

        // Compilation: verify all tiers pass and final has kind + confidence
        let details = classify_command_detailed("cargo build --release");
        assert_eq!(details.original, "cargo build --release");
        assert!(details.classification.is_compilation);
        assert_eq!(
            details.classification.kind,
            Some(CompilationKind::CargoBuild)
        );
        assert!(details.classification.confidence >= 0.90);
        // Should have 5 tiers: 0-4
        assert_eq!(details.tiers.len(), 5, "Should have 5 tier decisions");
        for tier in &details.tiers[..4] {
            assert_eq!(tier.decision, TierDecision::Pass);
        }
        // Tier 4 should also pass (compilation detected)
        assert_eq!(details.tiers[4].decision, TierDecision::Pass);
        assert_eq!(details.tiers[4].tier, 4);

        // Non-compilation: should reject early at Tier 2 (keyword filter)
        let details = classify_command_detailed("ls -la");
        assert!(!details.classification.is_compilation);
        assert!(
            details.tiers.len() >= 3,
            "Should have at least 3 tiers for keyword rejection"
        );
        assert_eq!(details.tiers.last().unwrap().decision, TierDecision::Reject);

        // Never-intercept: should reject at Tier 3
        let details = classify_command_detailed("cargo fmt --check");
        assert!(!details.classification.is_compilation);
        assert!(
            details.tiers.len() >= 4,
            "Should have at least 4 tiers for never-intercept rejection"
        );
        // Find tier 3
        let tier3 = details.tiers.iter().find(|t| t.tier == 3).unwrap();
        assert_eq!(tier3.decision, TierDecision::Reject);
        assert!(
            tier3.reason.contains("never-intercept"),
            "Tier 3 reason should mention never-intercept, got: {:?}",
            tier3.reason
        );

        // Pipe into a NON-benign command: rejected at Tier 1 (structure
        // analysis). A pipe into a benign pager (grep/tee/head) is offloaded
        // instead (issue #24), so use a non-pager target here.
        let details = classify_command_detailed("cargo build | xargs rm");
        assert!(!details.classification.is_compilation);
        let tier1 = details.tiers.iter().find(|t| t.tier == 1).unwrap();
        assert_eq!(tier1.decision, TierDecision::Reject);
        assert!(tier1.reason.contains("piped"));

        // Empty command: should reject at Tier 0
        let details = classify_command_detailed("");
        assert!(!details.classification.is_compilation);
        assert_eq!(details.tiers[0].tier, 0);
        assert_eq!(details.tiers[0].decision, TierDecision::Reject);
    }

    // ------------------------------------------------------------------
    // 16. Decision path completeness: every positive case has reason code
    // ------------------------------------------------------------------

    #[test]
    fn regression_every_compilation_has_reason_and_confidence() {
        let _guard = test_guard!();
        let compilation_cmds = [
            "cargo build",
            "cargo test",
            "cargo check",
            "cargo clippy",
            "cargo doc",
            "cargo run",
            "cargo bench",
            "cargo nextest run",
            "rustc main.rs",
            "gcc -c main.c -o main.o",
            "g++ -c main.cpp -o main.o",
            "clang -c main.c -o main.o",
            "clang++ -c main.cpp -o main.o",
            "make",
            "cmake --build build",
            "ninja",
            "meson compile",
            "bun test",
            "bun typecheck",
        ];
        for cmd in compilation_cmds {
            let result = classify_command(cmd);
            assert!(result.is_compilation, "{cmd:?} should be compilation");
            assert!(
                result.kind.is_some(),
                "{cmd:?} should have a CompilationKind"
            );
            assert!(
                result.confidence > 0.0,
                "{cmd:?} should have non-zero confidence"
            );
            assert!(
                !result.reason.is_empty(),
                "{cmd:?} should have a non-empty reason"
            );
        }
    }

    // ------------------------------------------------------------------
    // 17. Decision path completeness: every negative case has reason code
    // ------------------------------------------------------------------

    #[test]
    fn regression_every_rejection_has_reason() {
        let _guard = test_guard!();
        let non_compilation_cmds = [
            "",
            "ls",
            "pwd",
            "git status",
            "cargo fmt",
            "cargo install ripgrep",
            "cargo clean",
            "bun install",
            "bun add react",
            "bun run dev",
            "bun dev",
            "bun repl",
            "bun x vitest",
            "bun test --watch",
            "bun typecheck -w",
            "make clean",
            "ninja clean",
            "gcc --version",
            "rustc --version",
            "cargo build | xargs rm",
            "cargo build < input.txt",
            "cargo build || echo failed",
            "(cargo build)",
        ];
        for cmd in non_compilation_cmds {
            let result = classify_command(cmd);
            assert!(
                !result.is_compilation,
                "{cmd:?} should NOT be compilation, got kind={:?}",
                result.kind
            );
            assert!(
                !result.reason.is_empty(),
                "{cmd:?} should have a non-empty rejection reason"
            );
            assert_eq!(result.kind, None, "{cmd:?} should have no CompilationKind");
            assert_eq!(
                result.confidence, 0.0,
                "{cmd:?} should have zero confidence"
            );
        }
    }

    // ------------------------------------------------------------------
    // 18. Representative real-world agent workflow commands
    // ------------------------------------------------------------------

    #[test]
    fn regression_real_world_agent_workflows() {
        let _guard = test_guard!();

        // Typical Claude Code agent workflow: navigation + build
        let cd_build = classify_command(
            "cd /data/projects/remote_compilation_helper && cargo build --workspace --all-targets",
        );
        assert!(
            cd_build.is_compilation,
            "agent cd+build workflow should be intercepted"
        );

        // Agent running tests after code change
        let test_ws = classify_command("cargo test --workspace -- --nocapture");
        assert!(test_ws.is_compilation);
        assert_eq!(test_ws.kind, Some(CompilationKind::CargoTest));

        // Agent running clippy check
        let clippy = classify_command("cargo clippy --workspace --all-targets -- -D warnings");
        assert!(clippy.is_compilation);
        assert_eq!(clippy.kind, Some(CompilationKind::CargoClippy));

        // Agent checking format (should NOT intercept — modifies source)
        let fmt = classify_command("cargo fmt --check");
        assert!(!fmt.is_compilation);

        // Agent reading Cargo.toml (should NOT intercept)
        let cat = classify_command("cat Cargo.toml");
        assert!(!cat.is_compilation);

        // Agent checking git status (should NOT intercept)
        let gs = classify_command("git status");
        assert!(!gs.is_compilation);

        // Agent installing a tool (should NOT intercept)
        let install = classify_command("cargo install cargo-nextest");
        assert!(!install.is_compilation);

        // Agent running specific package tests
        let pkg_test = classify_command("cargo test -p rch-common");
        assert!(pkg_test.is_compilation);
        assert_eq!(pkg_test.kind, Some(CompilationKind::CargoTest));

        // Agent running with environment variable
        let env_test = classify_command("RUST_BACKTRACE=1 cargo test --workspace");
        assert!(env_test.is_compilation);
        assert_eq!(env_test.kind, Some(CompilationKind::CargoTest));

        // Agent running nextest
        let nxt = classify_command("cargo nextest run --workspace --no-fail-fast");
        assert!(nxt.is_compilation);
        assert_eq!(nxt.kind, Some(CompilationKind::CargoNextest));
    }

    // ------------------------------------------------------------------
    // 19. Boundary: commands that contain keywords but are NOT compilation
    // ------------------------------------------------------------------

    #[test]
    fn regression_keyword_in_non_compilation_context() {
        let _guard = test_guard!();
        // "cargo" appears as substring in path or argument, not as command
        let result = classify_command("echo cargo build");
        // "echo" has no compilation keyword... wait, "cargo" IS a keyword
        // but the command starts with "echo", which isn't a compilation command.
        // After normalization, it should still start with "echo".
        assert!(
            !result.is_compilation,
            "echo cargo should not compile, got: {:?}",
            result.reason
        );

        // grep for "make" in a log file - keyword present but not a build command
        let result = classify_command("grep make Makefile");
        // "make" is a keyword so passes Tier 2, but starts with "grep", not "make"
        assert!(
            !result.is_compilation,
            "grep make should not compile, got: {:?}",
            result.reason
        );

        // cat a file with "gcc" in its name
        let result = classify_command("cat gcc_output.log");
        // "gcc" keyword passes Tier 2, but the command is "cat"
        assert!(
            !result.is_compilation,
            "cat gcc_output should not compile, got: {:?}",
            result.reason
        );
    }

    #[test]
    fn regression_build_words_in_non_build_arguments_are_not_compilation() {
        let _guard = test_guard!();
        let cases = [
            r#"br comments add ft-4tp7g.1 "remote proof blocked: cargo test -p rchd --lib""#,
            r#"AGENT_NAME=Codex br comments add ft-4tp7g.1 "proof lane: cargo clippy --workspace""#,
            r#"printf "cargo build --release""#,
            r#"echo 'cargo test -p rchd -- --nocapture'"#,
            r#"grep "cmake --build" docs/proof-notes.md"#,
        ];

        for cmd in cases {
            let result = classify_command(cmd);
            assert!(
                !result.is_compilation,
                "embedded build text should not compile for {cmd:?}: {:?}",
                result
            );
            assert_eq!(result.reason.as_ref(), "no compilation keyword");
        }
    }

    #[test]
    fn golden_non_build_arguments_with_build_words_stay_non_compilation() {
        let _guard = test_guard!();
        const FIXTURE_PATH: &str =
            "../../tests/goldens/ft_4tp7g/classification_non_build_arguments.json";

        #[derive(serde::Deserialize)]
        struct Golden {
            schema_version: String,
            cases: Vec<Case>,
            expected_results: serde_json::Value,
        }

        #[derive(serde::Deserialize)]
        struct Case {
            name: String,
            command: String,
        }

        let golden: Golden = serde_json::from_str(include_str!(
            "../../tests/goldens/ft_4tp7g/classification_non_build_arguments.json"
        ))
        .expect("classification golden fixture parses");
        assert_eq!(
            golden.schema_version,
            "rch.golden.classification_non_build_arguments.v1"
        );

        let mut actual_results = Vec::with_capacity(golden.cases.len());
        for case in golden.cases {
            let result = classify_command(&case.command);
            actual_results.push(serde_json::json!({
                "name": case.name,
                "is_compilation": result.is_compilation,
                "kind": result.kind,
                "reason": result.reason.as_ref(),
            }));
        }
        assert_golden_json(
            serde_json::Value::Array(actual_results),
            &golden.expected_results,
            FIXTURE_PATH,
        );
    }

    #[test]
    fn regression_keyword_filter_still_accepts_normalized_build_invocations() {
        let _guard = test_guard!();
        let cases = [
            ("RUST_BACKTRACE=1 cargo test", CompilationKind::CargoTest),
            (
                "env 'CARGO_TARGET_DIR=/data/tmp/rch-target' cargo build",
                CompilationKind::CargoBuild,
            ),
            ("sudo -E cargo check", CompilationKind::CargoCheck),
            ("/usr/bin/time cargo build", CompilationKind::CargoBuild),
        ];

        for (cmd, expected_kind) in cases {
            let result = classify_command(cmd);
            assert!(
                result.is_compilation,
                "normalized build invocation should compile for {cmd:?}: {:?}",
                result
            );
            assert_eq!(result.kind, Some(expected_kind));
        }
    }

    // ------------------------------------------------------------------
    // 20. CompilationKind properties: is_test_command, command_base
    // ------------------------------------------------------------------

    #[test]
    fn regression_compilation_kind_properties() {
        let _guard = test_guard!();

        // Test commands
        assert!(CompilationKind::CargoTest.is_test_command());
        assert!(CompilationKind::CargoNextest.is_test_command());
        assert!(CompilationKind::CargoBench.is_test_command());
        assert!(CompilationKind::BunTest.is_test_command());

        // Non-test commands
        assert!(!CompilationKind::CargoBuild.is_test_command());
        assert!(!CompilationKind::CargoCheck.is_test_command());
        assert!(!CompilationKind::CargoClippy.is_test_command());
        assert!(!CompilationKind::CargoDoc.is_test_command());
        assert!(!CompilationKind::BunTypecheck.is_test_command());
        assert!(!CompilationKind::Gcc.is_test_command());
        assert!(!CompilationKind::Gpp.is_test_command());
        assert!(!CompilationKind::Clang.is_test_command());
        assert!(!CompilationKind::Clangpp.is_test_command());
        assert!(!CompilationKind::Make.is_test_command());
        assert!(!CompilationKind::CmakeBuild.is_test_command());
        assert!(!CompilationKind::Ninja.is_test_command());
        assert!(!CompilationKind::Meson.is_test_command());
        assert!(!CompilationKind::Rustc.is_test_command());

        // command_base
        assert_eq!(CompilationKind::CargoBuild.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoTest.command_base(), "cargo");
        assert_eq!(CompilationKind::CargoNextest.command_base(), "cargo");
        assert_eq!(CompilationKind::Rustc.command_base(), "rustc");
        assert_eq!(CompilationKind::Gcc.command_base(), "gcc");
        assert_eq!(CompilationKind::Gpp.command_base(), "g++");
        assert_eq!(CompilationKind::Clang.command_base(), "clang");
        assert_eq!(CompilationKind::Clangpp.command_base(), "clang++");
        assert_eq!(CompilationKind::Make.command_base(), "make");
        assert_eq!(CompilationKind::CmakeBuild.command_base(), "cmake");
        assert_eq!(CompilationKind::Ninja.command_base(), "ninja");
        assert_eq!(CompilationKind::Meson.command_base(), "meson");
        assert_eq!(CompilationKind::BunTest.command_base(), "bun");
        assert_eq!(CompilationKind::BunTypecheck.command_base(), "bun");
    }
}

#[cfg(test)]
mod tests_go_and_typescript {
    use super::*;

    fn kind_of(cmd: &str) -> Option<CompilationKind> {
        classify_command(cmd).kind
    }

    // --- Go: the offloadable forms ---

    #[test]
    fn go_build_test_vet_are_classified() {
        assert_eq!(kind_of("go build ./..."), Some(CompilationKind::GoBuild));
        assert_eq!(kind_of("go test ./..."), Some(CompilationKind::GoTest));
        assert_eq!(kind_of("go vet ./..."), Some(CompilationKind::GoVet));
        // Real commands observed hammering the orchestrator.
        assert_eq!(
            kind_of("go test -tags=e2e ./e2e -run ^TestE2EAtomicAssignment$"),
            Some(CompilationKind::GoTest)
        );
        assert_eq!(
            kind_of("go test ./internal/robot ./internal/cli -run TestExitCode"),
            Some(CompilationKind::GoTest)
        );
    }

    #[test]
    fn go_commands_clear_the_confidence_threshold() {
        // Default confidence_threshold is 0.85; anything at or below it is never
        // intercepted, which would silently keep these local.
        for cmd in ["go build ./...", "go test ./...", "go vet ./..."] {
            let c = classify_command(cmd);
            assert!(
                c.confidence > 0.85,
                "{cmd} scored {} which does not clear the 0.85 threshold",
                c.confidence
            );
        }
    }

    #[test]
    fn go_test_is_a_test_command() {
        // Drives cache affinity, the test-slot bucket, and the test timeout.
        assert!(CompilationKind::GoTest.is_test_command());
        assert!(!CompilationKind::GoBuild.is_test_command());
        assert!(!CompilationKind::GoVet.is_test_command());
    }

    // --- Go: forms that MUST stay local (would otherwise lose artifacts) ---

    #[test]
    fn go_build_with_output_flag_is_not_offloaded() {
        // Go kinds are stream-only (no artifact sync-back). Offloading an
        // emitting build would report success and leave no binary behind.
        assert_eq!(kind_of("go build -o bin/app ./cmd/app"), None);
        assert_eq!(kind_of("go build -o=bin/app ./cmd/app"), None);
    }

    #[test]
    fn go_test_c_and_exec_stay_local() {
        assert_eq!(kind_of("go test -c ./pkg"), None);
        assert_eq!(kind_of("go test -exec sudo ./pkg"), None);
    }

    #[test]
    fn go_state_mutating_subcommands_are_never_intercepted() {
        for cmd in [
            "go get github.com/foo/bar",
            "go mod tidy",
            "go mod download",
            "go install ./cmd/tool",
            "go run main.go",
            "go generate ./...",
            "go fmt ./...",
            "go clean -cache",
            "go work sync",
            "go env GOPATH",
            "go version",
            "go list ./...",
            "go tool pprof",
        ] {
            assert_eq!(kind_of(cmd), None, "{cmd} must never be intercepted");
        }
    }

    #[test]
    fn go_prefixed_binaries_are_not_matched() {
        // Keyword matching is whole-word, so these must not be treated as `go`.
        assert_eq!(kind_of("gofmt -l ."), None);
        assert_eq!(kind_of("golangci-lint run"), None);
    }

    // --- TypeScript ---

    #[test]
    fn tsc_noemit_is_classified() {
        assert_eq!(kind_of("tsc --noEmit"), Some(CompilationKind::Tsc));
        assert_eq!(kind_of("npx tsc --noEmit"), Some(CompilationKind::Tsc));
        // Observed in the wild.
        assert_eq!(
            kind_of("npx tsc --noEmit --incremental false"),
            Some(CompilationKind::Tsc)
        );
        // tsc flags are case-insensitive.
        assert_eq!(kind_of("tsc --noemit"), Some(CompilationKind::Tsc));
    }

    #[test]
    fn emitting_tsc_stays_local() {
        // Without --noEmit, tsc writes .js/.d.ts into the local tree. Tsc is
        // stream-only, so offloading it would silently produce no output.
        assert_eq!(kind_of("tsc"), None);
        assert_eq!(kind_of("tsc -p tsconfig.json"), None);
        assert_eq!(kind_of("npx tsc --outDir dist"), None);
    }

    #[test]
    fn tsc_watch_is_not_intercepted() {
        assert_eq!(kind_of("tsc --noEmit --watch"), None);
        assert_eq!(kind_of("tsc --noEmit -w"), None);
    }

    #[test]
    fn tsc_trivial_forms_are_not_intercepted() {
        assert_eq!(kind_of("tsc --version"), None);
        assert_eq!(kind_of("tsc --init"), None);
    }

    #[test]
    fn npx_non_tsc_is_not_intercepted() {
        // "npx" is a compilation keyword only so `npx tsc` reaches classify_full;
        // every other npx invocation must fall through.
        assert_eq!(kind_of("npx jest"), None);
        assert_eq!(kind_of("npx prettier --write ."), None);
    }

    // --- command_base drives the execution allowlist ---

    #[test]
    fn command_base_is_allowlisted() {
        use crate::types::ExecutionConfig;
        let exec = ExecutionConfig::default();
        for kind in [
            CompilationKind::GoBuild,
            CompilationKind::GoTest,
            CompilationKind::GoVet,
            CompilationKind::Tsc,
        ] {
            let base = kind.command_base();
            assert!(
                exec.is_allowed(base),
                "{base} missing from the execution allowlist — the hook would fail \
                 open to LOCAL execution, silently losing offload"
            );
        }
        assert_eq!(CompilationKind::GoBuild.command_base(), "go");
        assert_eq!(CompilationKind::Tsc.command_base(), "tsc");
    }
}